Amazon Linux 2 : dovecot (ALAS-2020-1489)

The version of dovecot installed on the remote host is prior to 2.2.36-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1489 advisory. In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zer...

Amazon Linux 2 : mod_http2 (ALAS-2020-1493)

The version of modhttp2 installed on the remote host is prior to 1.15.14-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1493 advisory. Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 reque...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2020-1434)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.265.b01-0.54. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1434 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries...

Amazon Linux AMI : clamav (ALAS-2020-1433)

The version of clamav installed on the remote host is prior to 0.102.4-1.44. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1433 advisory. Fixed a vulnerability in the ARJ archive-parsing module in ClamAV 0.102.3 that could cause a denial-of- service DoS...

Important: kernel-livepatch-4.14.192-147.314

Issue Overview: An issue has been reported in the Linux kernel's handling of raw sockets. This issue can be used locally to cause denial of service or local privilege escalation from unprivileged processes or from containers with the CAPNETRAW capability enabled. See Also:...

Important: kernel-livepatch-4.14.186-146.268

Issue Overview: An issue has been reported in the Linux kernel's handling of raw sockets. This issue can be used locally to cause denial of service or local privilege escalation from unprivileged processes or from containers with the CAPNETRAW capability enabled. See Also:...

Amazon Linux 2 : kernel (ALAS-2020-1488)

The version of kernel installed on the remote host is prior to 4.14.193-149.317. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1488 advisory. An issue has been reported in the Linux kernel's handling of raw sockets. This issue can be used locally to cause denial of...

Amazon Linux AMI : kernel (ALAS-2020-1430)

The version of kernel installed on the remote host is prior to 4.14.193-113.317. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1430 advisory. 2024-05-23: CVE-2020-14356 was added to this advisory. A flaw null pointer dereference in the Linux kernel cgroupv2...

Amazon Linux AMI : python34, python36, python35 (ALAS-2020-1432)

The version of python34 installed on the remote host is prior to 3.4.10-1.52. The version of python35 installed on the remote host is prior to 3.5.9-1.28. The version of python36 installed on the remote host is prior to 3.6.12-1.19. It is, therefore, affected by multiple vulnerabilities as...

Amazon Linux AMI : chrony (ALAS-2020-1431)

The version of chrony installed on the remote host is prior to 3.2-1.27. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1431 advisory. A flaw was found in chrony when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup...

Important: kernel

Issue Overview: An issue has been reported in the Linux kernel's handling of raw sockets. This issue can be used locally to cause denial of service or local privilege escalation from unprivileged processes or from containers with the CAPNETRAW capability enabled. See Also:...

Amazon Linux 2 : squid (ALAS-2020-1486)

The version of squid installed on the remote host is prior to 3.5.20-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1486 advisory. An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive informatio...

Amazon Linux 2 : thunderbird (ALAS-2020-1487)

The version of thunderbird installed on the remote host is prior to 68.11.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1487 advisory. Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit hea...

Amazon Linux 2 : qemu (ALAS-2020-1485)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1485 advisory. A use after free vulnerability in ipreass in ipinput.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial o...

Amazon Linux 2 : python (ALAS-2020-1483)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1483 advisory. In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by...

Amazon Linux 2 : postgresql-jdbc (ALAS-2020-1482)

The version of postgresql-jdbc installed on the remote host is prior to 9.2.1002-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1482 advisory. PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE. A flaw was found in PostgreSQL JDBC in versions prior to...

Important: postgresql-jdbc

Issue Overview: PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE. A flaw was found in PostgreSQL JDBC in versions prior to 42.2.13. An XML External Entity XXE weakness was found in PostgreSQL JDBC. The highest threat from this vulnerability is to data confidentiality and system...

Amazon Linux 2 : python3 (ALAS-2020-1484)

The version of python3 installed on the remote host is prior to 3.7.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1484 advisory. Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes,...

Medium: python

Issue Overview: In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks header validation. CVE-2019-20907 Affected Packages: python Note: This advisory is applicable to Amazon Linux 2 AL2...

Amazon Linux AMI : samba (ALAS-2020-1424)

The version of samba installed on the remote host is prior to 4.10.4-11.51. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1424 advisory. A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when...