Important: docker

Issue Overview: A flaw was discovered in the API endpoint behind the 'docker cp' command. The endpoint is vulnerable to a Time Of Check to Time Of Use TOCTOU vulnerability in the way it handles symbolic links inside a container. An attacker who has compromised an existing container can cause...

Amazon Linux AMI : containerd, docker (ALAS-2021-1551)

The version of containerd installed on the remote host is prior to 1.4.6-7.11. The version of docker installed on the remote host is prior to 20.10.7-5.76. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1551 advisory. In the OCI Distribution Specification version 1.0...

Medium: docker

Issue Overview: A flaw was found in moby. Moby buildkit calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call. CVE-2020-27534 Affected Packages: docker Note: This advisory is applicable to Amazon Linux 2 -...

Important: runc

Issue Overview: runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfslinux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory. CVE-2019-16884 A flaw was...

Important: runc

Issue Overview: runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfslinux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory. CVE-2019-16884 A flaw was...

Amazon Linux AMI : curl (ALAS-2021-1549)

The version of curl installed on the remote host is prior to 7.61.1-12.100. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1549 advisory. A flaw was found in curl. This flaw lies in the --ssl-reqd option or related settings in libcurl. Users specify this fla...

Amazon Linux AMI : docker (ALAS-2021-1550)

The version of docker installed on the remote host is prior to 20.10.7-2.69. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1550 advisory. A flaw was found in the userns-remap feature of Docker. The root user in the remapped namespace can modify files under...

Important: kernel-livepatch-5.10.59-52.142

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-5.10.59-52.142 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-5.10.59-52.142 or yum update --advisory ALAS2LIVEPATCH-2021-067 to update your system. New...

Important: kernel-livepatch-5.10.62-55.141

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-5.10.62-55.141 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-5.10.62-55.141 or yum update --advisory ALAS2LIVEPATCH-2021-068 to update your system. New...

Important: kernel-livepatch-5.10.50-44.131

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-5.10.50-44.131 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-5.10.50-44.131 or yum update --advisory ALAS2LIVEPATCH-2021-065 to update your system. New...

Amazon Linux 2 : thunderbird (ALAS-2021-1720)

The version of thunderbird installed on the remote host is prior to 78.14.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1720 advisory. Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these bugs showe...

Amazon Linux 2 : kernel (ALAS-2021-1719)

The version of kernel installed on the remote host is prior to 4.14.252-195.481. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1719 advisory. A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2021-1718)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.13+8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1718 advisory. There is a flaw in the xml entity encoding functionality of libxml2. An attacker who is able to supply...

Amazon Linux AMI : c-ares (ALAS-2021-1545)

The version of c-ares installed on the remote host is prior to 1.17.2-1.8. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1545 advisory. A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can...

Amazon Linux AMI : tomcat8 (ALAS-2021-1547)

The version of tomcat8 installed on the remote host is prior to 8.5.69-1.88. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1547 advisory. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP...

Amazon Linux AMI : mysql57 (ALAS-2021-1544)

The version of mysql57 installed on the remote host is prior to 5.7.35-1.17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1544 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are...

Amazon Linux AMI : tomcat8 (ALAS-2021-1546)

The version of tomcat8 installed on the remote host is prior to 8.5.72-1.89. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1546 advisory. A memory leak flaw was found in Apache Tomcat, where an HTTP upgrade connection does not release for WebSocket connections once...

Low: hivex

Issue Overview: A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry hive file, which would cause hivex to recursively call the getchildren function, leading to a stack overflow. The highest threat from this vulnerability is to system...

Medium: openssl

Issue Overview: It was found that openssl assumed ASN.1 strings to be NUL terminated. A malicious actor may be able to force an application into calling openssl function with a specially crafted, non-NUL terminated string to deliberately hit this bug, which may result in a crash of the applicatio...

Amazon Linux 2 : hivex (ALAS-2021-1717)

The version of hivex installed on the remote host is prior to 1.3.10-6.12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1717 advisory. A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry hive file, whic...