Amazon Linux AMI : kernel (ALAS-2023-1792)

The version of kernel installed on the remote host is prior to 4.14.320-169.544. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1792 advisory. A use-after-free vulnerability in the Linux kernel's net/sched: clsu32 component can be exploited to achieve local...

Amazon Linux 2 : python-setuptools (ALAS-2023-2196)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2196 advisory. Python Packaging Authority PyPA setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denia...

Amazon Linux 2023 : grpc, grpc-cpp, grpc-data (ALAS2023-2023-282)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-282 advisory. 2023-10-12: CVE-2023-4785 was added to this advisory. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table...

Amazon Linux 2 : wireshark (ALAS-2023-2187)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2187 advisory. VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted...

Amazon Linux AMI : avahi (ALAS-2023-1790)

The version of avahi installed on the remote host is prior to 0.6.25-12.19. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1790 advisory. A reachable assertion was found in avahidnspacketappendrecord. CVE-2023-38469 A reachable assertion was found in...

Amazon Linux 2 : avahi (ALAS-2023-2175)

The version of avahi installed on the remote host is prior to 0.6.31-20. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2175 advisory. A reachable assertion was found in avahidnspacketappendrecord. CVE-2023-38469 A reachable assertion was found in...

Amazon Linux 2 : cri-tools (ALAS-2023-2194)

The version of cri-tools installed on the remote host is prior to 1.26.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2194 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the...

Amazon Linux 2 : ruby (ALAS-2023-2201)

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2201 advisory. An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A...

Amazon Linux 2023 : iwl100-firmware, iwl105-firmware, iwl135-firmware (ALAS2023-2023-284)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-284 advisory. An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. CVE-2023-20593 Tenable has extracted the preceding description...

Amazon Linux 2 : kernel (ALAS-2023-2179)

The version of kernel installed on the remote host is prior to 4.14.320-243.544. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2179 advisory. 2023-08-31: CVE-2023-20569 was added to this advisory. A side channel vulnerability on some of the AMD CPUs may...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2023-276)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-276 advisory. Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices with the %pipe% prefix or the | pipe character prefix. CVE-2023-36664 Tenable has extracted the preceding descriptio...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2023-1797)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.382.b05-1.78. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1797 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

Amazon Linux 2 : tomcat (ALAS-2023-2200)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2200 advisory. The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data...

Amazon Linux 2 : python-pygments (ALAS-2023-2198)

The version of python-pygments installed on the remote host is prior to 1.4-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2198 advisory. In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some o...

Amazon Linux AMI : openssh (ALAS-2023-1794)

The version of openssh installed on the remote host is prior to 7.4p1-22.78. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1794 advisory. An issue was discovered in OpenSSH 7.4 on Amazon Linux 2 and Amazon Linux 1. The fix for CVE-2019-6111 only covered cases where ...

Amazon Linux 2 : aspell (ALAS-2023-2199)

The version of aspell installed on the remote host is prior to 0.60.6.1-22. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2199 advisory. objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::duptop called from acommon::StringMap::add...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2023-026)

The version of containerd installed on the remote host is prior to 1.6.19-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2023-026 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Large handshake records may caus...

Amazon Linux 2 : elfutils (ALAS-2023-2197)

The version of elfutils installed on the remote host is prior to 0.176-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2197 advisory. In elfutils 0.183, an infinite loop was found in the function handlesymtab in readelf.c .Which allows attackers to cause a denial ...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2023-283)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-283 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to...

Amazon Linux 2 : openssh (ALAS-2023-2176)

The version of openssh installed on the remote host is prior to 7.4p1-22. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2176 advisory. The PKCS11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code...