Amazon Linux AMI : python27 (ALAS-2022-1593)

The version of python27 installed on the remote host is prior to 2.7.18-2.142. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1593 advisory. In Python3's Lib/test/multibytecodecsupport.py CJK codec tests call eval on content retrieved via HTTP. CVE-2020-2761...

Amazon Linux AMI : rubygem-nokogiri, rubygem18-nokogiri (ALAS-2022-1595)

The version of rubygem18-nokogiri installed on the remote host is prior to 1.5.11-1.16. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1595 advisory. Nokogiri is an open source XML and HTML library for Ruby. Nokogiri = 1.13.4. There are no known workarounds for this...

Amazon Linux AMI : kernel (ALAS-2022-1591)

The version of kernel installed on the remote host is prior to 4.14.281-144.502. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1591 advisory. A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMAFROMDEVICE. This flaw...

Amazon Linux 2 : containerd, docker (ALASNITRO-ENCLAVES-2022-019)

The version of containerd installed on the remote host is prior to 1.4.13-2. The version of docker installed on the remote host is prior to 20.10.13-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO- ENCLAVES-2022-019 advisory. A flaw was found in Moby Docker Engine...

Amazon Linux AMI : aide (ALAS-2022-1587)

The version of aide installed on the remote host is prior to 0.14-7.9. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1587 advisory. A heap-based buffer overflow vulnerability in the base64 functions of AIDE, an advanced intrusion detection system. An attacker could...

Amazon Linux AMI : expat (ALAS-2022-1588)

The version of expat installed on the remote host is prior to 2.1.0-12.28. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1588 advisory. In Expat aka libexpat before 2.4.3, a left shift by 29 or more places in the storeAtts function in xmlparse.c can lead to realloc...

Amazon Linux AMI : rsyslog (ALAS-2022-1594)

The version of rsyslog installed on the remote host is prior to 5.8.10-9.29. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1594 advisory. A flaw was found in the way rsyslog handled invalid log message priority values. In certain configurations, a local...

Amazon Linux AMI : containerd (ALAS-2022-1600)

The version of containerd installed on the remote host is prior to 1.4.13-3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1600 advisory. A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume...

Amazon Linux AMI : python-twisted-conch (ALAS-2022-1592)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1592 advisory. An uncontrolled resource consumption flaw was found in python-twisted in the dataReceived function. This flaw allows an unauthenticated, remote attacker to send a simple command to use all available memory...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-014)

The version of kernel installed on the remote host is prior to 5.10.118-111.515. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-014 advisory. In the Linux kernel, the following vulnerability has been resolved: dm: fix mempool NULL pointer race wh...

Amazon Linux AMI : git (ALAS-2022-1589)

The version of git installed on the remote host is prior to 2.36.1-1.75. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1589 advisory. A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system...

Amazon Linux AMI : gzip (ALAS-2022-1590)

The version of gzip installed on the remote host is prior to 1.5-9.20. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1590 advisory. An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name...

Medium: containerd

Issue Overview: A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the ExecSync API. This can cause containerd to consume all available memory on the computer, denying service to...

Amazon Linux 2 : kernel, --advisory ALAS2-2022-1798 (ALAS-2022-1798)

The version of kernel installed on the remote host is prior to 4.14.281-212.502. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1798 advisory. In the Linux kernel, the following vulnerability has been resolved: dm: fix mempool NULL pointer race when...

Medium: openssl

Issue Overview: The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the...

Amazon Linux 2 : microcode_ctl (ALAS-2022-1800)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1800 advisory. A flaw was found in hw. Processor optimization removal or modification of security-critical code for some IntelR processors may...

Amazon Linux 2 : openssl (ALAS-2022-1801)

The version of openssl installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1801 advisory. The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by so...

Amazon Linux 2 : thunderbird (ALAS-2022-1804)

The version of thunderbird installed on the remote host is prior to 91.9.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1804 advisory. The Mozilla Foundation Security Advisory describes this flaw as:An attacker could have sent a message to the parent...

Amazon Linux 2 : libtiff (ALAS-2022-1799)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1799 advisory. A flaw was found in libtiff where a NULL source pointer passed as an argument to the memcpy function within the TIFFReadDirectory ...

Amazon Linux 2 : vim, --advisory ALAS2-2022-1805 (ALAS-2022-1805)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1805 advisory. A flaw was found in vim. The vulnerability occurs due to a crash when recording and using Select mode and leads to an out-of-bounds read. This flaw allows an attacker to input a specially crafted...