Low: redis6

Issue Overview: Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time,...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-036)

"The version of kernel installed on the remote host is prior to 5.15.148-97.158. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-036 advisory. 2024-12-05: CVE-2023-52683 was added to this advisory. 2024-12-05: CVE-2023-52693 was added to this...

Amazon Linux 2 : kernel (ALAS-2024-2443)

"The version of kernel installed on the remote host is prior to 4.14.336-255.557. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2443 advisory. An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 netfilter:...

Amazon Linux 2 : thunderbird (ALAS-2024-2440)

The version of thunderbird installed on the remote host is prior to 115.7.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2440 advisory. An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitabl...

Amazon Linux 2023 : redis6 (ALAS2023-2024-513)

The version of redis6 installed on the remote host is prior to 6.2.14-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-513 advisory. - Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-048)

"The version of kernel installed on the remote host is prior to 5.10.209-198.812. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-048 advisory. 2024-12-05: CVE-2023-52683 was added to this advisory. 2024-12-05: CVE-2023-52693 was added to this...

Amazon Linux 2 : snakeyaml (ALAS-2024-2450)

The version of snakeyaml installed on the remote host is prior to 1.11-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2450 advisory. Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user...

Amazon Linux 2023 : ansible-core, ansible-test (ALAS2023-2024-505)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-505 advisory. The upstream report describes this issue as follows: When installing a maliciously created Ansible role using 'ansible-galaxy role install', arbitrary files the user has access to can be...

Amazon Linux 2023 : pam, pam-devel (ALAS2023-2024-502)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-502 advisory. A vulnerability was found in Linux PAM. An unprivileged user that is not yet in a corresponding mount namespace with /tmp mounted as a polyinstantiated dir can place a FIFO there, and a subsequent attem...

Amazon Linux AMI : postfix (ALAS-2024-1914)

The version of postfix installed on the remote host is prior to 2.6.6-2.17. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1914 advisory. Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpddatarestrictions=rejectunauthpipelining and...

Amazon Linux 2 : python3-jinja2 (ALAS-2024-2437)

The version of python3-jinja2 installed on the remote host is prior to 2.7.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2437 advisory. Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. ...

Amazon Linux 2 : rear (ALAS-2024-2451)

The version of rear installed on the remote host is prior to 2.00-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2451 advisory. Relax-and-Recover aka ReaR through 2.7 creates a world-readable initrd when using GRUBRESCUE=y. This allows local attackers to gain...

Amazon Linux 2 : cri-tools (ALAS-2024-2446)

The version of cri-tools installed on the remote host is prior to 1.29.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2446 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read ma...

Amazon Linux 2 : kernel (ALAS-2024-2448)

The version of kernel installed on the remote host is prior to 4.14.305-227.531. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2448 advisory. A memory corruption flaw was found in the Linux kernel's human interface device HID subsystem in how a user inserts a...

Amazon Linux 2 : squid (ALAS-2024-2445)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2445 advisory. Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 throug...

Amazon Linux 2 : nss (ALAS-2024-2442)

The version of nss installed on the remote host is prior to 3.90.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2442 advisory. A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord...

Amazon Linux 2 : sudo (ALAS-2024-2447)

The version of sudo installed on the remote host is prior to 1.8.23-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2447 advisory. 2024-02-22: CVE-2023-42465 was removed from this advisory. 2024-02-22: The severity of this advisory has been changed from important...

Amazon Linux 2023 : nspr, nspr-devel, nss (ALAS2023-2024-507)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-507 advisory. A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make...

Amazon Linux 2023 : sudo, sudo-devel, sudo-logsrvd (ALAS2023-2024-514)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-514 advisory. 2024-02-26: The severity of this advisory has been changed from important to low. Sudo before 1.9.15 might allow row hammer attacks for authentication bypass or privilege escalation because application...

Amazon Linux 2 : wireshark (ALAS-2024-2441)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2441 advisory. IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injecti...