Medium: qt5-qtbase

Issue Overview: QT-based clients may mismatch HSTS headers Strict-Transport-Security, which would prevent the client from switching to a secure HTTPS connection as requested by a server. CVE-2023-32762 Affected Packages: qt5-qtbase Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Medium: kernel

Issue Overview: A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality. CVE-2023-20588 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference...

Medium: hwloc

Issue Overview: An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c. CVE-2022-47022 Affected Packages: hwloc Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit...

Important: ca-certificates

Issue Overview: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an...

Low: ImageMagick

Issue Overview: No CVE associated with this advisory Affected Packages: ImageMagick Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update ImageMagick or yum...

Medium: cri-tools

Issue Overview: 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192...

Medium: curl

Issue Overview: Integer overflow vulnerability in tooloperate.c in curl 7.65.2 via crafted value as the retry delay. CVE-2020-19909 libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before i...

Advisory ROSA-SA-2023-2223

Software: nss 3.53.1 OS: ROSA Virtualization 2.1 packageevrstring: nss-3.53.1-17.rv3.1c.src.rpm CVE-ID: CVE-2020-12403 BDU-ID: None CVE-Crit: CRITICAL CVE-DESC.: A bug was discovered in the way CHACHA20-POLY1305 is implemented in NSS in versions prior to 3.55. When using a Chacha20 consisting of...

Important: runc

Issue Overview: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

Important: nerdctl

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send...

Low: gawk

Issue Overview: A heap out-of-bounds read flaw was found in builtin.c in the gawk package which may result in a crash of the software. CVE-2023-4156 Affected Packages: gawk Issue Correction: Run dnf update gawk --releasever 2023.1.20230825 or dnf update --advisory ALAS2023-2023-292 --releasever...

Medium: libtiff

Issue Overview: LibTIFF 4.4.0 has an out-of-bounds write in TIFFmemcpy in libtiff/tifunix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available...

Important: libqb

Issue Overview: logblackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered. CVE-2023-39976 Affected Packages: libqb Issue Correction: Run dnf update libqb --releasever 2023.1.20230825 or dnf update --advisory ALAS2023-2023-294...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2023-296)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-296 advisory. 2024-02-15: CVE-2020-21710 was added to this advisory. A divide by zero issue discovered in epsprintpage in gdevepsn.c in Artifex Software GhostScript 9.50 allows remote attackers to cause a...

Amazon Linux 2023 : doxygen2man, libqb, libqb-devel (ALAS2023-2023-294)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-294 advisory. logblackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered. CVE-2023-39976 Tenable has extracted the preceding description block directl...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-306)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-306 advisory. Issue summary: The AES-SIV cipher implementation contains a bug that causesit to ignore empty associated data entries which are unauthenticated asa consequence. Impact summary: Applications tha...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2023-310)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-310 advisory. 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fi...

Amazon Linux 2023 : ca-certificates (ALAS2023-2023-297)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-297 advisory. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-316)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-316 advisory. When doing NTLM authentication, the client sends replies tocryptographic challenges back to the server. These replieshave variable length. Winbind did not properly bounds-checkthe lan manager...

Amazon Linux 2023 : guava, guava-javadoc, guava-testlib (ALAS2023-2023-305)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-305 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...