Amazon Linux 2022 : clamav, clamav-data, clamav-devel (ALAS2022-2022-090)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-090 advisory. A vulnerability in the OOXML parsing module in Clam AntiVirus ClamAV Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause...

Amazon Linux 2022 : cups, cups-client, cups-devel (ALAS2022-2022-108)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-108 advisory. An authorization vulnerability was found in the CUPS printing system. This security vulnerability occurs when local authorization happens. This flaw allows an attacker to authenticate to CUPS as...

Amazon Linux 2022 : httpd, httpd-core, httpd-devel (ALAS2022-2022-110)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-110 advisory. An HTTP request smuggling vulnerability was found in the modproxyajp module of httpd. This flaw allows an attacker to smuggle requests to the AJP server, where it forwards requests...

Amazon Linux 2022 : bsdcat, bsdcpio, bsdtar (ALAS2022-2022-059)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-059 advisory. An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provid...

Amazon Linux 2022 : openssl (ALAS2022-2022-104)

The version of openssl installed on the remote host is prior to 3.0.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-104 advisory. The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is...

Amazon Linux 2022 : java-latest-openjdk, java-latest-openjdk-demo, java-latest-openjdk-devel (ALAS2022-2022-037)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-037 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported versions that are affected are Oracle Java SE: 7u321, 8u311,...

Amazon Linux 2022 : java-11-openjdk, java-11-openjdk-demo, java-11-openjdk-devel (ALAS2022-2022-047)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-047 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported versions that are affected are Oracle Java SE: 7u321, 8u311,...

Amazon Linux 2022 : python3-twisted, python3-twisted+tls (ALAS2022-2022-046)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-046 advisory. An uncontrolled resource consumption flaw was found in python-twisted in the dataReceived function. This flaw allows an unauthenticated, remote attacker to send a simple command to use all available...

Amazon Linux 2022 : minizip-compat, minizip-compat-devel, zlib (ALAS2022-2022-100)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-100 advisory. An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has many distant matches. For some rare inputs with a large number of...

Amazon Linux 2022 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2022-2022-043)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-043 advisory. A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severit...

Amazon Linux 2022 : postgresql14, postgresql14-contrib, postgresql14-llvmjit (ALAS2022-2022-124)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-124 advisory. A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH...

Amazon Linux 2022 : containerd, containerd-stress, docker (ALAS2022-2022-054)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-054 advisory. A flaw was found in Moby Docker Engine, where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with...

Amazon Linux 2022 : zziplib, zziplib-devel, zziplib-utils (ALAS2022-2022-081)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-081 advisory. Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value zzipfileread in the function unzzipcatfile. CVE-2020-18442 Tenable has extracted the preceding...

Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-055)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-055 advisory. A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials s...

Amazon Linux 2022 : rsyslog, rsyslog-crypto, rsyslog-elasticsearch (ALAS2022-2022-075)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-075 advisory. A flaw was found in the way rsyslog handled invalid log message priority values. In certain configurations, a local attacker, or a remote attacker able to connect to the rsyslog port, could use...

Amazon Linux 2022 : containerd, containerd-stress (ALAS2022-2022-088)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-088 advisory. A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the ExecSync API. This can cause...

Amazon Linux 2022 : logrotate (ALAS2022-2022-084)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-084 advisory. A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock...

Amazon Linux 2022 : python3-lxml (ALAS2022-2022-074)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-074 advisory. There's a flaw in python-lxml's HTML Cleaner component, which is responsible for sanitizing HTML and Javascript. An attacker who is able to submit a crafted payload to a web service using python-lxml's...

Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-042)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-042 advisory. A flaw was found in the Linux kernel in linux/net/netfilter/nftablesapi.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue. CVE-2022-1015 A flaw w...

Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-065)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-065 advisory. A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials s...