Amazon Linux 2 : jettison (ALAS-2023-2363)

The version of jettison installed on the remote host is prior to 1.3.3-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2363 advisory. Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS. If the parser is...

Medium: wireshark

Issue Overview: A heap based buffer overflow in Wireshark's NetScreen file parser may lead to a local arbitrary code execution via a crafted capture file. CVE-2023-6175 Affected Packages: wireshark Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for...

Amazon Linux 2 : openssl-snapsafe (ALASOPENSSL-SNAPSAFE-2023-004)

The version of openssl-snapsafe installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2OPENSSL-SNAPSAFE-2023-004 advisory. Issue summary: Generating excessively long X9.42 DH keys or checkingexcessively long X9.42 DH keys or...

Amazon Linux 2 : ecs-init (ALASECS-2023-020)

The version of ecs-init installed on the remote host is prior to 1.79.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-020 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

Amazon Linux 2 : containerd (ALASECS-2023-026)

The version of containerd installed on the remote host is prior to 1.4.6-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-026 advisory. The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OC...

Medium: containerd

Issue Overview: The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Image Specification, the manifest and index documents were not self-describing and documents with a single digest could be interpreted as either a manife...

Amazon Linux 2 : containerd (ALASECS-2023-023)

The version of containerd installed on the remote host is prior to 1.4.13-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-023 advisory. A flaw was found in Moby Docker Engine, where containers were started incorrectly with non-empty inheritable Linux process...

Amazon Linux 2 : containerd (ALASECS-2023-027)

The version of containerd installed on the remote host is prior to 1.4.6-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-027 advisory. containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in...

Medium: containerd

Issue Overview: containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-056)

The version of kernel installed on the remote host is prior to 5.4.259-173.361. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-056 advisory. 2024-06-06: CVE-2023-52477 was added to this advisory. A race condition between two functions, lmLogClose...

Amazon Linux 2 : docker (ALASECS-2023-025)

The version of docker installed on the remote host is prior to 20.10.7-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-025 advisory. The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI...

Medium: docker

Issue Overview: The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Image Specification, the manifest and index documents were not self-describing and documents with a single digest could be interpreted as either a manife...

Amazon Linux 2 : containerd (ALASECS-2023-030)

The version of containerd installed on the remote host is prior to 1.4.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-030 advisory. A flaw was found in containerd. Access controls for the shim API socket verified that a connecting process had an effective UI...

Medium: containerd

Issue Overview: A bug was found in containerd where containers launched through containerd's CRI implementation with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on...

Amazon Linux 2 : containerd (ALASECS-2023-024)

The version of containerd installed on the remote host is prior to 1.4.6-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-024 advisory. A bug was found in containerd where containers launched through containerd's CRI implementation with a specially-crafted image...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-043)

The version of kernel installed on the remote host is prior to 5.10.199-190.747. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-043 advisory. 2024-07-03: CVE-2023-52504 was added to this advisory. 2024-06-06: CVE-2023-52477 was added to this...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2023-034)

The version of containerd installed on the remote host is prior to 1.6.6-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2023-034 advisory. In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-017)

The version of firefox installed on the remote host is prior to 115.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-017 advisory. A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an inopportu...

Amazon Linux 2 : containerd (ALASECS-2023-029)

The version of containerd installed on the remote host is prior to 1.4.6-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-029 advisory. A flaw was found in containerd where pulling and extracting a specially-crafted container image can result in Unix file...

Medium: containerd

Issue Overview: A flaw was found in containerd where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host's filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to...