Medium: cups

Issue Overview: A vulnerability was found in CUPS. This issue occurs due to logging data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data immediately before the connection closed, resulting in a use-after-free in cupsdAcceptClient in...

Important: rclone

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Affected Packages: rclone Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run y...

Medium: python-pip

Issue Overview: A vulnerability was found in the way the ipaddress python module computes hash values in the IPv4Interface and IPv6Interface classes. This flaw allows an attacker to create many dictionary entries, due to the performance of a dictionary containing the IPv4Interface or IPv6Interfac...

Important: kernel-livepatch-6.1.29-47.49

Issue Overview: In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. CVE-2022-48425 Affected Packages: kernel-livepatch-6.1.29-47.49 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Amazon Linux 2 : ecs-init, docker, containerd, runc (ALASECS-2022-001)

The version of containerd installed on the remote host is prior to 1.4.13-3. The version of docker installed on the remote host is prior to 20.10.13-2. The version of ecs-init installed on the remote host is prior to 1.61.1-1. The version of runc installed on the remote host is prior to 1.0.3-3. ...

Amazon Linux 2 : runc (ALASECS-2023-004)

The version of runc installed on the remote host is prior to 1.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-004 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was foun...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2023-003)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.25.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-003 advisory. Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-234)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-234 advisory. Reserved CVE CVE-2023-3269 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for this issue but has instead relied...

Amazon Linux AMI : kernel (ALAS-2023-1776)

The version of kernel installed on the remote host is prior to 4.14.318-167.530. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1776 advisory. An issue was found in the Linux kernel's IPv6 TCP connection tracking code, which could lead to high CPU usage with certain...

Amazon Linux AMI : squid (ALAS-2023-1774)

The version of squid installed on the remote host is prior to 3.5.20-17.49. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1774 advisory. An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When...

Amazon Linux AMI : kernel (ALAS-2023-1773)

The version of kernel installed on the remote host is prior to 4.14.318-166.529. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1773 advisory. 2024-02-01: CVE-2024-0775 was added to this advisory. A use-after-free flaw was found in nftables cross-table in th...

Amazon Linux AMI : c-ares (ALAS-2023-1770)

The version of c-ares installed on the remote host is prior to 1.17.2-1.9. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1770 advisory. Denial of Service. An issue in c-ares was found where a 0-byte UDP payload can cause a Denial of Service CVE-2023-32067. Tenable h...

Amazon Linux AMI : glib2 (ALAS-2023-1775)

The version of glib2 installed on the remote host is prior to 2.36.3-5.26. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1775 advisory. Heap-based buffer overflow in the findfixedlength function in pcrecompile.c in PCRE before 8.38 allows remote attackers t...

Amazon Linux AMI : mod24_security (ALAS-2023-1772)

The version of mod24security installed on the remote host is prior to 2.8.0-5.28. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1772 advisory. In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web...

Amazon Linux AMI : perl-HTTP-Tiny (ALAS-2023-1771)

The version of perl-HTTP-Tiny installed on the remote host is prior to 0.033-3.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1771 advisory. Warning has been added when HTTP::Tiny is used without verifyssl flag CVE-2023-31486 Tenable has extracted the preceding...

Amazon Linux 2 : qt5-qtbase (ALAS-2023-2091)

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2091 advisory. An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for...

Amazon Linux 2 : qt (ALAS-2023-2090)

The version of qt installed on the remote host is prior to 4.8.5-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2090 advisory. An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS do...

Amazon Linux 2 : ncurses (ALAS-2023-2096)

The version of ncurses installed on the remote host is prior to 6.0-8.20170212. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2096 advisory. ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security- relevant memory...

Amazon Linux 2 : openssl11 (ALAS-2023-2097)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2097 advisory. Issue summary: Processing some specially crafted ASN.1 object identifiers ordata containing them may be very slow. Impact...

Amazon Linux 2 : perl-HTTP-Tiny (ALAS-2023-2093)

The version of perl-HTTP-Tiny installed on the remote host is prior to 0.033-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2093 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuratio...