Amazon Linux 2 : python-urllib3 (ALAS-2021-1668)

The version of python-urllib3 installed on the remote host is prior to 1.25.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1668 advisory. A flaw was found in python-urllib3. The HTTPConnection.request does not properly validate CRLF sequences in the HTTP reques...

Medium: wpa_supplicant

Issue Overview: In p2pcopyclientinfo of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no additional execution privileges needed. User interaction is not needed f...

Medium: systemd

Issue Overview: It was discovered that systemd is vulnerable to a state injection attack when deserializing the state of a service. Properties longer than LINEMAX are not correctly parsed and an attacker may abuse this flaw in particularly configured services to inject, change, or corrupt the...

Amazon Linux 2 : postgresql (ALAS-2021-1665)

The version of postgresql installed on the remote host is prior to 9.2.24-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1665 advisory. A flaw was discovered in postgresql where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER...

Medium: curl

Issue Overview: It was discovered that libcurl did not remove authentication credentials from URLs when automatically populating the Referer HTTP request header while handling HTTP redirects. This could lead to exposure of the credentials to the server to which requests were redirected...

Amazon Linux 2 : curl (ALAS-2021-1653)

The version of curl installed on the remote host is prior to 7.61.1-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1653 advisory. It was discovered that libcurl did not remove authentication credentials from URLs when automatically populating the Refere...

Amazon Linux 2 : glibc (ALAS-2021-1656)

The version of glibc installed on the remote host is prior to 2.26-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1656 advisory. In the GNU C Library aka glibc or libc6 through 2.29, proceednextnode in posix/regexec.c has a heap- based buffer over-read...

Amazon Linux 2 : bind (ALAS-2021-1651)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1651 advisory. Incremental zone transfers IXFR provide a way of transferring changed portions of a zone between servers. An IXFR stream containi...

Amazon Linux 2 : golang (ALAS-2021-1657)

The version of golang installed on the remote host is prior to 1.15.12-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1657 advisory. A vulnerability was found in net/http of the Go standard library when parsing very large HTTP header values, causing a crash and...

Medium: glibc

Issue Overview: In the GNU C Library aka glibc or libc6 through 2.29, proceednextnode in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match. CVE-2019-9169 A flaw was found in glibc. If an attacker provides the iconv function with invalid...

Medium: libxml2

Issue Overview: GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e. CVE-2020-24977 There is a flaw in the xml entity encoding functionality of libxml2. An attacker who is able to...

Amazon Linux 2 : libX11 (ALAS-2021-1661)

The version of libX11 installed on the remote host is prior to 1.6.7-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1661 advisory. A flaw was found in libX11. An integer overflow leading to a heap-buffer overflow occurs when setuid programs call XIM client...

Amazon Linux AMI : nginx (ALAS-2021-1507)

The version of nginx installed on the remote host is prior to 1.18.0-1.43. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1507 advisory. A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot character o...

Low: lldpad

Issue Overview: lldptool can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an attacker to inject shell control characters into the buffer and impact the behavior of the terminal. CVE-2018-10932 Affected Packages: lldpad Note: This adviso...

Medium: openldap

Issue Overview: A NULL pointer dereference flaw was found in the OpenLDAP server, during a request for renaming RDNs. This flaw allows a remote, unauthenticated attacker to crash the slapd process by sending a specially crafted request, causing a denial of service. The highest threat from this...

Medium: python-pip

Issue Overview: The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in...

Amazon Linux 2 : openldap (ALAS-2021-1638)

The version of openldap installed on the remote host is prior to 2.4.44-23. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1638 advisory. A NULL pointer dereference flaw was found in the OpenLDAP server, during a request for renaming RDNs. This flaw allows a remote,...

Amazon Linux 2 : lldpad (ALAS-2021-1637)

The version of lldpad installed on the remote host is prior to 1.0.1-5.git036e314. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1637 advisory. lldptool can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an...

Amazon Linux 2 : python-pip (ALAS-2021-1639)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1639 advisory. The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting...

Amazon Linux 2 : thunderbird (ALAS-2021-1644)

The version of thunderbird installed on the remote host is prior to 78.10.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1644 advisory. Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both a...