Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2024-017)

The version of tomcat installed on the remote host is prior to 8.5.69-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2024-017 advisory. 2024-02-15: CVE-2021-30640 was added to this advisory. 2024-02-15: CVE-2021-33037 was added to this advisory. A...

Amazon Linux AMI : cacti (ALAS-2024-1915)

The version of cacti installed on the remote host is prior to 1.1.19-6.24. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1915 advisory. Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection SQLi vulnerabili...

Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2024-512)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-512 advisory. Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 which was about the expression parameter...

Amazon Linux 2 : thunderbird (ALAS-2024-2440)

The version of thunderbird installed on the remote host is prior to 115.7.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2440 advisory. An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitabl...

Amazon Linux 2 : python-jinja2 (ALAS-2024-2436)

The version of python-jinja2 installed on the remote host is prior to 2.7.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2436 advisory. Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. I...

Amazon Linux 2 : pcre2 (ALAS-2024-2449)

The version of pcre2 installed on the remote host is prior to 10.23-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2449 advisory. Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts...

Medium: python-jinja2

Issue Overview: Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting XSS. The Jinja xmlattr filter...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-048)

"The version of kernel installed on the remote host is prior to 5.10.209-198.812. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-048 advisory. 2024-12-05: CVE-2023-52683 was added to this advisory. 2024-12-05: CVE-2023-52693 was added to this...

Amazon Linux AMI : squid (ALAS-2024-1916)

The version of squid installed on the remote host is prior to 3.5.20-17.54. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1916 advisory. Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1...

Low: redis6

Issue Overview: Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time,...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-010)

The version of kernel installed on the remote host is prior to 5.4.162-86.275. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-010 advisory. 2024-08-27: CVE-2021-47190 was added to this advisory. 2024-08-27: CVE-2021-47184 was added to this advisor...

Amazon Linux 2023 : redis6 (ALAS2023-2024-513)

The version of redis6 installed on the remote host is prior to 6.2.14-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-513 advisory. - Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its...

Amazon Linux 2 : kernel (ALAS-2024-2443)

"The version of kernel installed on the remote host is prior to 4.14.336-255.557. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2443 advisory. An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 netfilter:...

Amazon Linux 2 : squid (ALAS-2024-2445)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2445 advisory. Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 throug...

Amazon Linux 2 : nss (ALAS-2024-2442)

The version of nss installed on the remote host is prior to 3.90.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2442 advisory. A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord...

Amazon Linux 2 : indent (ALAS-2024-2439)

The version of indent installed on the remote host is prior to 2.2.11-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2439 advisory. A flaw was found in Indent. This issue may allow a local user to use a specially-crafted file to trigger a heap-based buffer...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2024-011)

The version of tomcat installed on the remote host is prior to 9.0.50-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2024-011 advisory. 2024-02-15: CVE-2021-33037 was added to this advisory. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5...

Amazon Linux 2 : rear (ALAS-2024-2451)

The version of rear installed on the remote host is prior to 2.00-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2451 advisory. Relax-and-Recover aka ReaR through 2.7 creates a world-readable initrd when using GRUBRESCUE=y. This allows local attackers to gain...

Low: indent

Issue Overview: A flaw was found in Indent. This issue may allow a local user to use a specially-crafted file to trigger a heap-based buffer overflow, which can lead to an application crash. CVE-2024-0911 Affected Packages: indent Issue Correction: Run dnf update indent --releasever 2023.3.202402...

Amazon Linux 2 : wireshark (ALAS-2024-2441)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2441 advisory. IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injecti...