Amazon Linux AMI : postgresql-jdbc (ALAS-2021-1533)

The version of postgresql-jdbc installed on the remote host is prior to 8.4.704-4.13. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1533 advisory. A flaw was found in PostgreSQL JDBC in versions prior to 42.2.13. An XML External Entity XXE weakness was found in...

Amazon Linux AMI : tomcat7 (ALAS-2021-1534)

The version of tomcat7 installed on the remote host is prior to 7.0.109-1.41. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1534 advisory. A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name...

Medium: curl

Issue Overview: A flaw was found in libcurl in the way libcurl handles previously used connections without accounting for 'issuer cert' and comparing the involved paths case-insensitively. This flaw allows libcurl to use the wrong connection. The highest threat from this vulnerability is to...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2021-1695)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.302.b08-0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1695 advisory. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component:...

Important: kernel

Issue Overview: A flaw was found in the Linux kernel's KVM implementation, where improper handing of the VMIO|VMPFNMAP VMAs in KVM bypasses RO checks and leads to pages being freed while still accessible by the VMM and guest. This flaw allows users who can start and control a VM to read/write...

Amazon Linux 2 : golang (ALAS-2021-1694)

The version of golang installed on the remote host is prior to 1.15.14-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1694 advisory. A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially...

Amazon Linux 2 : kernel, --advisory ALAS2-2021-1696 (ALAS-2021-1696)

The version of kernel installed on the remote host is prior to 4.14.241-184.433. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1696 advisory. A flaw was found in the Linux kernel, where a BPF program can obtain sensitive information from kernel memory via ...

Amazon Linux 2 : curl (ALAS-2021-1693)

The version of curl installed on the remote host is prior to 7.76.1-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1693 advisory. A flaw was found in libcurl from versions 7.29.0 through 7.71.1. An application that performs multiple requests with libcurl...

Amazon Linux 2 : linuxptp (ALAS-2021-1697)

The version of linuxptp installed on the remote host is prior to 2.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1697 advisory. A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports...

Amazon Linux 2 : xstream (ALAS-2021-1698)

The version of xstream installed on the remote host is prior to 1.3.1-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1698 advisory. A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to obtain sufficient rights...

Medium: golang

Issue Overview: A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially exhaust system memory when parsing malformed ZIP files. CVE-2021-33196 A flaw was found in golang. A panic can be triggered by an attacker in a privileged netwo...

Important: java-1.8.0-openjdk

Issue Overview: Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1...

Amazon Linux 2 : kernel (ALAS-2021-1691)

The version of kernel installed on the remote host is prior to 4.14.238-182.422. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1691 advisory. An out-of-bounds write flaw was found in the Linux kernel's seqfile in the Filesystem layer. This flaw allows a local...

Amazon Linux AMI : kernel (ALAS-2021-1524)

The version of kernel installed on the remote host is prior to 4.14.238-125.422. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1524 advisory. An out-of-bounds write flaw was found in the Linux kernel's seqfile in the Filesystem layer. This flaw allows a local attack...

Amazon Linux AMI : containerd (ALAS-2021-1523)

The version of containerd installed on the remote host is prior to 1.4.6-2.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1523 advisory. A bug was discovered in containerd where pulling and extracting a specially-crafted container image can result in Unix file...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2021-1692)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.12+7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1692 advisory. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component:...

Important: kernel-livepatch-4.14.232-176.381

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-4.14.232-176.381 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-4.14.232-176.381 or yum update --advisory ALAS2LIVEPATCH-2021-054 to update your system. New...

Important: java-11-amazon-corretto

Issue Overview: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerabilit...

Important: kernel-livepatch-4.14.232-176.381

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-4.14.232-176.381 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-4.14.232-176.381 or yum update --advisory ALAS2LIVEPATCH-2021-056 to update your system. New...

Important: kernel-livepatch-4.14.232-177.418

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-4.14.232-177.418 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-4.14.232-177.418 or yum update --advisory ALAS2LIVEPATCH-2021-059 to update your system. New...