Important: runc

Issue Overview: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

Medium: kernel

Issue Overview: A buffer overrun vulnerability was found in the netback driver in Xen due to an unusual split packet. This flaw allows an unprivileged guest to cause a denial of service DoS of the host by sending network packets to the backend, causing the backend to crash. CVE-2023-34319 A...

Medium: edk2

Issue Overview: Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being...

Medium: golang

Issue Overview: 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192...

Amazon Linux 2 : yajl (ALAS-2023-2182)

The version of yajl installed on the remote host is prior to 2.0.4-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2182 advisory. There's a memory leak in yajl 2.1.0 with use of yajltreeparse function. which will cause out-of-memory in server and cause crash...

Amazon Linux 2023 : bouncycastle, bouncycastle-javadoc, bouncycastle-mail (ALAS2023-2023-280)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-280 advisory. A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence o...

Amazon Linux 2023 : avahi, avahi-autoipd, avahi-compat-howl (ALAS2023-2023-272)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-272 advisory. A reachable assertion was found in avahidnspacketappendrecord. CVE-2023-38469 A reachable assertion was found in avahiescapelabel. CVE-2023-38470 A reachable assertion was found in...

Amazon Linux 2 : python-configobj (ALAS-2023-2188)

The version of python-configobj installed on the remote host is prior to 4.7.2-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2188 advisory. All versions of the package configobj are vulnerable to Regular Expression Denial of Service ReDoS via the validate...

Amazon Linux 2 : nghttp2 (ALAS-2023-2180)

The version of nghttp2 installed on the remote host is prior to 1.41.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2180 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

Amazon Linux 2023 : openssh, openssh-clients, openssh-keycat (ALAS2023-2023-273)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-273 advisory. The PKCS11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if the target user's ssh-agent is forwarded to an...

Amazon Linux 2023 : poppler, poppler-cpp, poppler-cpp-devel (ALAS2023-2023-289)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-289 advisory. Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder JBIG2Stream::readTextRegionSeg in JBIGStream.cc. Processing a specially crafted PDF file or JBIG2 image could lea...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-290)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-290 advisory. Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrusted user data is provided as a range...

Amazon Linux AMI : cups (ALAS-2023-1796)

The version of cups installed on the remote host is prior to 1.4.2-67.23. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1796 advisory. OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow ...

Amazon Linux 2 : webkitgtk4 (ALAS-2023-2177)

The version of webkitgtk4 installed on the remote host is prior to 2.38.5-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2177 advisory. A vulnerability was found in webkitgtk. This issue occurs when processing web content, which may lead to arbitrary code...

Amazon Linux 2 : cni-plugins (ALAS-2023-2192)

The version of cni-plugins installed on the remote host is prior to 1.2.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2192 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Tenable has extracted the preceding description block...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-038)

The version of kernel installed on the remote host is prior to 5.10.186-179.751. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-038 advisory. 2024-07-03: CVE-2023-3389 was added to this advisory. 2023-08-31: CVE-2023-20569 was added to this...

Amazon Linux 2 : golang (ALAS-2023-2186)

The version of golang installed on the remote host is prior to 1.20.6-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2186 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional...

Amazon Linux 2 : ImageMagick (ALAS-2023-2178)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2178 advisory. A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel function in quantum- private.h. This issue may...

Amazon Linux AMI : nghttp2 (ALAS-2023-1793)

The version of nghttp2 installed on the remote host is prior to 1.33.0-1.1.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1793 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

Amazon Linux AMI : ImageMagick (ALAS-2023-1791)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1.27. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1791 advisory. A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel function in quantum- private.h. This issue ma...