Amazon Linux AMI : tomcat7 (ALAS-2021-1534)

The version of tomcat7 installed on the remote host is prior to 7.0.109-1.41. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1534 advisory. A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name...

Amazon Linux AMI : lasso (ALAS-2021-1529)

The version of lasso installed on the remote host is prior to 2.5.1-8.6. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1529 advisory. An XML Signature Wrapping XSW vulnerability was found in Lasso. This flaw allows an attacker to modify a valid SAML response to...

Amazon Linux AMI : golang (ALAS-2021-1527)

The version of golang installed on the remote host is prior to 1.15.14-1.69. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1527 advisory. A flaw was found in Go, acting as an unintended proxy or intermediary, where ReverseProxy forwards connection headers i...

Amazon Linux AMI : tomcat8 (ALAS-2021-1535)

The version of tomcat8 installed on the remote host is prior to 8.5.69-1.88. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1535 advisory. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding...

Amazon Linux AMI : php73 (ALAS-2021-1532)

The version of php73 installed on the remote host is prior to 7.3.29-1.30. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1532 advisory. Several flaws has been found in php. The pdofirebase module does not check the length of the server version string in a...

Amazon Linux AMI : curl (ALAS-2021-1525)

The version of curl installed on the remote host is prior to 7.61.1-12.99. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1525 advisory. A flaw was found in libcurl in the way libcurl handles previously used connections without accounting for 'issuer cert' and...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2021-1528)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.302.b08-0.67. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1528 advisory. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component:...

Amazon Linux AMI : openvpn (ALAS-2021-1531)

The version of openvpn installed on the remote host is prior to 2.4.11-1.48. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1531 advisory. OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2021-1695)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.302.b08-0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1695 advisory. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component:...

Medium: curl

Issue Overview: A flaw was found in libcurl in the way libcurl handles previously used connections without accounting for 'issuer cert' and comparing the involved paths case-insensitively. This flaw allows libcurl to use the wrong connection. The highest threat from this vulnerability is to...

Important: kernel

Issue Overview: A flaw was found in the Linux kernel's KVM implementation, where improper handing of the VMIO|VMPFNMAP VMAs in KVM bypasses RO checks and leads to pages being freed while still accessible by the VMM and guest. This flaw allows users who can start and control a VM to read/write...

Amazon Linux 2 : xstream (ALAS-2021-1698)

The version of xstream installed on the remote host is prior to 1.3.1-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1698 advisory. A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to obtain sufficient rights...

Amazon Linux 2 : curl (ALAS-2021-1693)

The version of curl installed on the remote host is prior to 7.76.1-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1693 advisory. A flaw was found in libcurl from versions 7.29.0 through 7.71.1. An application that performs multiple requests with libcurl...

Amazon Linux 2 : kernel, --advisory ALAS2-2021-1696 (ALAS-2021-1696)

The version of kernel installed on the remote host is prior to 4.14.241-184.433. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1696 advisory. A flaw was found in the Linux kernel, where a BPF program can obtain sensitive information from kernel memory via ...

Amazon Linux 2 : linuxptp (ALAS-2021-1697)

The version of linuxptp installed on the remote host is prior to 2.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1697 advisory. A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports...

Amazon Linux 2 : golang (ALAS-2021-1694)

The version of golang installed on the remote host is prior to 1.15.14-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1694 advisory. A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially...

Important: java-1.8.0-openjdk

Issue Overview: Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1...

Medium: golang

Issue Overview: A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially exhaust system memory when parsing malformed ZIP files. CVE-2021-33196 A flaw was found in golang. A panic can be triggered by an attacker in a privileged netwo...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2021-1692)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.12+7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1692 advisory. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component:...

Amazon Linux AMI : containerd (ALAS-2021-1523)

The version of containerd installed on the remote host is prior to 1.4.6-2.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1523 advisory. A bug was discovered in containerd where pulling and extracting a specially-crafted container image can result in Unix file...