Medium: python-pip

Issue Overview: A flaw was found in python-urllib3. SSL certificate validation is omitted in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy if an SSLContext isn't given via proxyconfig doesn't verify the hostname of the certificate. This means certificates...

Medium: microcode_ctl

Issue Overview: A flaw was found in the Intel Advanced Vector Extensions AVX implementation, where a local authenticated attacker with the ability to execute AVX instructions can gather the AVX register state from previous AVX executions. This vulnerability allows information disclosure of the AV...

Important: glib2

Issue Overview: An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function gbytesnew has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption. CVE-2021-27219 Affected...

Low: bzip2

Issue Overview: BZ2decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. CVE-2019-12900 Affected Packages: bzip2 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Cor...

Amazon Linux 2 : nss (ALAS-2021-1664)

The version of nss installed on the remote host is prior to 3.53.1-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1664 advisory. A flaw was found in the way NSS handled CCS ChangeCipherSpec messages in TLS 1.3. This flaw allows a remote attacker to send multiple...

Amazon Linux 2 : lasso (ALAS-2021-1660)

The version of lasso installed on the remote host is prior to 2.5.1-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1660 advisory. An XML Signature Wrapping XSW vulnerability was found in Lasso. This flaw allows an attacker to modify a valid SAML response to inclu...

Amazon Linux 2 : libX11 (ALAS-2021-1661)

The version of libX11 installed on the remote host is prior to 1.6.7-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1661 advisory. A flaw was found in libX11. An integer overflow leading to a heap-buffer overflow occurs when setuid programs call XIM client...

Medium: curl

Issue Overview: It was discovered that libcurl did not remove authentication credentials from URLs when automatically populating the Referer HTTP request header while handling HTTP redirects. This could lead to exposure of the credentials to the server to which requests were redirected...

Amazon Linux 2 : golang (ALAS-2021-1657)

The version of golang installed on the remote host is prior to 1.15.12-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1657 advisory. A vulnerability was found in net/http of the Go standard library when parsing very large HTTP header values, causing a crash and...

Amazon Linux 2 : curl (ALAS-2021-1653)

The version of curl installed on the remote host is prior to 7.61.1-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1653 advisory. It was discovered that libcurl did not remove authentication credentials from URLs when automatically populating the Refere...

Medium: nss

Issue Overview: A flaw was found in the way NSS handled CCS ChangeCipherSpec messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system...

Medium: systemd

Issue Overview: It was discovered that systemd is vulnerable to a state injection attack when deserializing the state of a service. Properties longer than LINEMAX are not correctly parsed and an attacker may abuse this flaw in particularly configured services to inject, change, or corrupt the...

Low: samba

Issue Overview: No CVE associated with this advisory Affected Packages: samba Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update samba or yum update...

Medium: python-urllib3

Issue Overview: A flaw was found in python-urllib3. The HTTPConnection.request does not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation of the request by injecting additional HTTP headers. The highest threat from this vulnerability is to...

Amazon Linux 2 : slapi-nis (ALAS-2021-1646)

The version of slapi-nis installed on the remote host is prior to 0.56.5-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1646 advisory. A flaw was found in slapi-nis. A NULL pointer dereference during the parsing of the Binding DN could allow an unauthenticated...

Amazon Linux 2 : glibc (ALAS-2021-1656)

The version of glibc installed on the remote host is prior to 2.26-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1656 advisory. In the GNU C Library aka glibc or libc6 through 2.29, proceednextnode in posix/regexec.c has a heap- based buffer over-read...

Amazon Linux 2 : python-lxml (ALAS-2021-1666)

The version of python-lxml installed on the remote host is prior to 3.2.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1666 advisory. A Cross-site Scripting XSS vulnerability was found in the python-lxml's clean module. The module's parser did not properly...

Amazon Linux 2 : wpa_supplicant (ALAS-2021-1648)

The version of wpasupplicant installed on the remote host is prior to 2.6-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1648 advisory. In p2pcopyclientinfo of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remot...

Amazon Linux 2 : qemu (ALAS-2021-1671)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1671 advisory. A heap buffer overflow flaw was found in the iSCSI support of QEMU. This flaw could lead to an out-of- bounds read access and...

Amazon Linux AMI : nginx (ALAS-2021-1507)

The version of nginx installed on the remote host is prior to 1.18.0-1.43. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1507 advisory. A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot character o...