Amazon Linux 2 : kernel (ALAS-2021-1691)

The version of kernel installed on the remote host is prior to 4.14.238-182.422. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1691 advisory. An out-of-bounds write flaw was found in the Linux kernel's seqfile in the Filesystem layer. This flaw allows a local...

Amazon Linux AMI : kernel (ALAS-2021-1524)

The version of kernel installed on the remote host is prior to 4.14.238-125.422. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1524 advisory. An out-of-bounds write flaw was found in the Linux kernel's seqfile in the Filesystem layer. This flaw allows a local attack...

Important: kernel-livepatch-4.14.231-173.360

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-4.14.231-173.360 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-4.14.231-173.360 or yum update --advisory ALAS2LIVEPATCH-2021-058 to update your system. New...

Important: kernel-livepatch-4.14.232-176.381

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-4.14.232-176.381 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-4.14.232-176.381 or yum update --advisory ALAS2LIVEPATCH-2021-054 to update your system. New...

Important: java-11-amazon-corretto

Issue Overview: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerabilit...

Important: kernel-livepatch-4.14.232-176.381

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-4.14.232-176.381 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-4.14.232-176.381 or yum update --advisory ALAS2LIVEPATCH-2021-056 to update your system. New...

Important: kernel-livepatch-4.14.232-177.418

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-4.14.232-177.418 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-4.14.232-177.418 or yum update --advisory ALAS2LIVEPATCH-2021-059 to update your system. New...

Amazon Linux 2 : velocity (ALAS-2021-1690)

The version of velocity installed on the remote host is prior to 1.7-10.2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1690 advisory. A flaw was found in velocity. An attacker, able to modify Velocity templates, may execute arbitrary Java code or run arbitrary...

Medium: python-urllib3

Issue Overview: A flaw was found in python-urllib3. When provided with a URL containing many @ characters in the authority component, the authority's regular expression exhibits catastrophic backtracking. This flaw causes a denial of service if a URL is passed as a parameter or redirected via an...

Amazon Linux 2 : python-urllib3 (ALAS-2021-1688)

The version of python-urllib3 installed on the remote host is prior to 1.25.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1688 advisory. A flaw was found in python-urllib3. When provided with a URL containing many @ characters in the authority component, the...

Amazon Linux 2 : kernel, --advisory ALAS2-2021-1685 (ALAS-2021-1685)

The version of kernel installed on the remote host is prior to 4.14.238-182.421. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1685 advisory. A vulnerability was found in the bluez, where Passkey Entry protocol used in Secure Simple Pairing SSP, Secure...

Amazon Linux 2 : openssl (ALAS-2021-1687)

The version of openssl installed on the remote host is prior to 1.0.2k-19. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1687 advisory. An integer overflow was found in the x6464 Montgomery squaring procedure used in exponentiation with 512-bit moduli. As per...

Amazon Linux 2 : libX11 (ALAS-2021-1686)

The version of libX11 installed on the remote host is prior to 1.6.7-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1686 advisory. A missing validation flaw was found in libX11. This flaw allows an attacker to inject X11 protocol commands on X clients, and in som...

Important: libX11

Issue Overview: A missing validation flaw was found in libX11. This flaw allows an attacker to inject X11 protocol commands on X clients, and in some cases, also bypass, authenticate via injection of control characters, or potentially execute arbitrary code with permissions of the application...

Amazon Linux 2 : rpm (ALAS-2021-1689)

The version of rpm installed on the remote host is prior to 4.11.3-40. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1689 advisory. A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can...

Amazon Linux 2 : grub2 (ALAS-2021-1684)

The version of grub2 installed on the remote host is prior to 2.06-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1684 advisory. 2024-02-29: CVE-2019-14865 was added to this advisory. A flaw was found in the grub2-set-bootflag utility of grub2. A local...

Amazon Linux AMI : postgresql96 (ALAS-2021-1520)

The version of postgresql96 installed on the remote host is prior to 9.6.22-1.85. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1520 advisory. A flaw was found in postgresql. While modifying certain SQL array values, missing bounds checks let authenticated database...

Amazon Linux AMI : graphviz (ALAS-2021-1513)

The version of graphviz installed on the remote host is prior to 2.38.0-18.52. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1513 advisory. A flaw was found in graphviz. A wrong assumption in recordinit function leads to an off-by-one write in parsereclbl function,...

Amazon Linux AMI : rpm (ALAS-2021-1521)

The version of rpm installed on the remote host is prior to 4.11.3-40.79. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1521 advisory. A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can...

Amazon Linux AMI : nss (ALAS-2021-1518)

The version of nss installed on the remote host is prior to 3.53.1-7.85. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1518 advisory. A flaw was found in the way NSS handled CCS ChangeCipherSpec messages in TLS 1.3. This flaw allows a remote attacker to send multipl...