Amazon Linux 2 : openssh (ALAS-2023-2376)

The version of openssh installed on the remote host is prior to 7.4p1-22. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2376 advisory. AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A...

Medium: openssh

Issue Overview: AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A protocol extension has been introduced by OpenSSH which needs to be applied to both the client and the server in order to address this issue. We recommen...

Amazon Linux 2023 : openssh, openssh-clients, openssh-keycat (ALAS2023-2023-462)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-462 advisory. AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A protocol extension has been introduced by OpenSSH which needs to be applie...

Amazon Linux AMI : openssh (ALAS-2023-1898)

The version of openssh installed on the remote host is prior to 7.4p1-22.81. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1898 advisory. AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-443)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-443 advisory. Issue summary: Generating excessively long X9.42 DH keys or checkingexcessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHgeneratekey...

Amazon Linux 2023 : avahi, avahi-autoipd, avahi-compat-howl (ALAS2023-2023-456)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-456 advisory. A reachable assertion was found in avahirdataparse. CVE-2023-38472 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not test...

Amazon Linux 2023 : squid (ALAS2023-2023-445)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-445 advisory. 2024-02-29: CVE-2024-25617 was added to this advisory. 2024-02-29: CVE-2023-49285 was removed from this advisory. 2024-02-29: The severity of this advisory has been changed from important to...

Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2023-442)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-442 advisory. When installing a package from a Mercurial VCS URL ie pip installhg+... with pip prior to v23.3, the specified Mercurial revision couldbe used to inject arbitrary configuration options to the hg cloneca...

Amazon Linux 2023 : traceroute (ALAS2023-2023-452)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-452 advisory. In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines. CVE-2023-46316 Tenable has extracted the preceding description block directly from the teste...

Amazon Linux 2023 : perl, perl-Attribute-Handlers, perl-AutoLoader (ALAS2023-2023-448)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-448 advisory. 2024-02-01: CVE-2023-47100 was added to this advisory. A crafted regular expression when compiled by perl 5.30.0 through 5.38.0 can cause a one-byte attacker controlled buffer overflow in a hea...

Amazon Linux 2023 : python3-urllib3 (ALAS2023-2023-454)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-454 advisory. urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the...

Amazon Linux 2023 : memcached, memcached-devel, memcached-selinux (ALAS2023-2023-449)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-449 advisory. In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the get substring. CVE-2023-46852 In Memcached before 1.6.22...

Amazon Linux 2023 : jbig2dec, jbig2dec-devel, jbig2dec-libs (ALAS2023-2023-451)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-451 advisory. Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2error at /jbig2dec/jbig2.c. CVE-2023-46361 Tenable has extracted the preceding description block directly from the...

Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-457)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-457 advisory. .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability CVE-2023-36049 ASP.NET Core - Security Feature Bypass Vulnerability CVE-2023-36558 Tenable has extracted the precedi...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-461)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-461 advisory. In the Linux kernel, the following vulnerability has been resolved: lib/generic-radix-tree.c: Don't overflow in peek CVE-2021-47432 In the Linux kernel, the following vulnerability has been...

Amazon Linux 2023 : shadow-utils, shadow-utils-subid, shadow-utils-subid-devel (ALAS2023-2023-450)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-450 advisory. A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to sto...

Amazon Linux 2023 : guava, guava-javadoc, guava-testlib (ALAS2023-2023-458)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-458 advisory. Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on t...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-447)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-447 advisory. Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to b...

Amazon Linux 2023 : python3-cryptography (ALAS2023-2023-459)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-459 advisory. cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions Cipher.updateinto would accept Python objects which implement the buffer...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-439)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-439 advisory. An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB...