Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1050)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1050 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: actmirred: don't override retval if we already lost the skb CVE-2024-26739 In the Linux kernel, the following...

Amazon Linux 2 : python3-urllib3 (ALAS-2025-2916)

The version of python3-urllib3 installed on the remote host is prior to 1.25.6-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2916 advisory. urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all...

Medium: runfinch-finch

Issue Overview: Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. CVE-2025-22874 Proxy-Authorization and Proxy-Authenticate headers...

Medium: golist

Issue Overview: Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. CVE-2025-4673 Affected Packages: golist Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...

Medium: containerd

Issue Overview: Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. CVE-2025-4673 Affected Packages: containerd Note: This advisory is applicable to Amazon Linux 2 - Nitro-enclaves Extra. Visit this page to learn more...

Medium: python3.12-pip

Issue Overview: Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc...

Medium: python-pip

Issue Overview: Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc...

Medium: python-cryptography

Issue Overview: python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS1 v1.5 ciphertext. CVE-2020-25659 Affected Packages: python-cryptography Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Vis...

Important: kernel-livepatch-4.14.355-277.643

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ext4: Fix possible corruption when moving a directory CVE-2023-53137 Affected Packages: kernel-livepatch-4.14.355-277.643 Issue Correction: Please ensure you have live patching enabled. Run yum update...

Amazon Linux 2023 : python3-urllib3 (ALAS2023-2025-1059)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1059 advisory. urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disab...

Low: python-pip

Issue Overview: No CVE associated with this advisory Affected Packages: python-pip Issue Correction: Run dnf update python-pip --releasever 2023.8.20250707 or dnf update --advisory ALAS2023-2025-1058 --releasever 2023.8.20250707 to update your system. More information on how to update your system...

Medium: libgepub

Issue Overview: A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. This issue causes the application to crash. Known affected usage includes desktop...

Amazon Linux 2023 : firefox (ALAS2023-2025-1055)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1055 advisory. A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability affects Firefox or tag, potentially making a website vulnerable to a cross- site scripting attac...

Amazon Linux 2 : kernel (ALAS-2025-2929)

The version of kernel installed on the remote host is prior to 4.14.355-280.651. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2929 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: Fix possible corruption when moving a...

Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2025-066)

The version of docker installed on the remote host is prior to 25.0.8-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2025-066 advisory. Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive...

Amazon Linux 2023 : glib2, glib2-devel, glib2-static (ALAS2023-2025-1069)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1069 advisory. A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the gdatetimenewfromiso8601 function. CVE-2025-3360 A flaw was fou...

Amazon Linux 2 : golist (ALAS-2025-2922)

The version of golist installed on the remote host is prior to 0.10.1-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2922 advisory. Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information...

Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2025-1058)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1058 advisory. urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disab...

Amazon Linux 2 : python3 (ALAS-2025-2923)

The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2923 advisory. There is an issue in CPython when using bytes.decodeunicodeescape, error=ignore|replace. If you are not using the...

Amazon Linux 2 : xorg-x11-server (ALAS-2025-2918)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2918 advisory. A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and...