Important: grpc

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-44487 Affected Packages: grpc Issue Correction: Run dnf update grpc --releaseve...

Medium: ansible-core

Issue Overview: The upstream bug report describes this issue as follows: A flaw was found in Ansible, where a user's controller is vulnerable to template injection when internal templating operations may errantly remove the unsafe designation from template data. CVE-2023-5764 Affected Packages:...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2024-471)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-471 advisory. Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2024-469)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-469 advisory. Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a :s command for the very first time and using a sub-replace-special atom inside the...

Medium: ecs-init

Issue Overview: Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. CVE-2023-3978 Affected Packages: ecs-init Issue Correction: Run dnf update ecs-init --releasever 2023.3.20240108 or dnf update...

Amazon Linux 2023 : p7zip, p7zip-plugins (ALAS2023-2024-481)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-481 advisory. p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the function NArchive::NZip::CInArchive::FindCdbool at CPP/7zip/Archive/Zip/ZipIn.cpp. CVE-2022-47069 Tenable has extracted...

Amazon Linux 2023 : bouncycastle, bouncycastle-javadoc, bouncycastle-mail (ALAS2023-2024-479)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-479 advisory. Bouncy Castle for Java before 1.73 contains a potential Denial of Service DoS issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams...

Amazon Linux 2023 : libssh, libssh-config, libssh-devel (ALAS2023-2024-468)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-468 advisory. AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A protocol extension has been introduced by OpenSSH which needs to be applie...

Amazon Linux 2023 : squid (ALAS2023-2024-467)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-467 advisory. Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a...

Medium: ecs-init

Issue Overview: Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. CVE-2023-3978 Affected Packages: ecs-init Issue Correction: Run dnf update ecs-init --releasever 2023.3.20240108 to update you...

Amazon Linux 2023 : ansible-core, ansible-test (ALAS2023-2024-465)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-465 advisory. The upstream bug report describes this issue as follows:A flaw was found in Ansible, where a user's controller is vulnerable to template injection when internal templating operations may errantly remove...

Amazon Linux 2023 : ecs-init (ALAS2023-2024-476)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-476 advisory. Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. CVE-2023-3978 Tenable has extracted the precedi...

Amazon Linux 2023 : ncurses, ncurses-base, ncurses-c++-libs (ALAS2023-2024-466)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-466 advisory. NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component ncwrapentry. CVE-2023-50495 Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2023 : tar (ALAS2023-2024-475)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-475 advisory. It was discovered that tar incorrectly handled extended attributes in PAX archives. An attacker could supply a specially crafted file and cause tar to crash, resulting in a denial of service...

Medium: p7zip

Issue Overview: p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the function NArchive::NZip::CInArchive::FindCdbool at CPP/7zip/Archive/Zip/ZipIn.cpp. CVE-2022-47069 Affected Packages: p7zip Issue Correction: Run dnf update p7zip --releasever 2023.3.20240108 or dnf...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2024-477)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-477 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP clie...

Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2024-464)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-464 advisory. Certain aggregate function calls receiving unknown-type arguments could disclose bytes of server memory from the end of the unknown-type value to the next zero byte. One typically gets an...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2024-472)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-472 advisory. This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies tha...

Amazon Linux 2023 : gnutls, gnutls-c++, gnutls-dane (ALAS2023-2024-463)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-463 advisory. A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS1 v1.5 padding. Only TLS ciphertext...

Important: kernel-livepatch-6.1.61-85.141

Issue Overview: A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. The function nfttransgccatchall did not remove the catchall set element from the catchalllist when the argument sync is true, making it possib...