Amazon Linux AMI : libarchive (ALAS-2020-1343)

The version of libarchive installed on the remote host is prior to 3.1.2-14.15. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1343 advisory. archivereadformatrarreaddata in archivereadsupportformatrar.c in libarchive before 3.4.0 has a use-after-free in a certain...

Important: apache-commons-beanutils

Issue Overview: In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the...

Amazon Linux AMI : python27, python35, python36 (ALAS-2020-1342)

The version of python27 installed on the remote host is prior to 2.7.16-1.131. The version of python35 installed on the remote host is prior to 3.5.7-1.25. The version of python36 installed on the remote host is prior to 3.6.10-1.16. It is, therefore, affected by a vulnerability as referenced in...

Amazon Linux 2 : thunderbird (ALAS-2020-1393)

The version of thunderbird installed on the remote host is prior to 68.4.1-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1393 advisory. When pasting a tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace...

Amazon Linux AMI : python-pip (ALAS-2020-1340)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1340 advisory. In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. CVE-2019-11236 The urllib3 library before 1.24.2 for Python mishandles...

Amazon Linux 2 : python-reportlab (ALAS-2020-1390)

The version of python-reportlab installed on the remote host is prior to 2.5-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1390 advisory. ReportLab through 3.5.26 allows remote code execution because of toColorevalarg in colors.py, as demonstrated by a crafted X...

Amazon Linux AMI : spamassassin (ALAS-2020-1341)

The version of spamassassin installed on the remote host is prior to 3.4.3-2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1341 advisory. In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA...

Amazon Linux 2 : libarchive (ALAS-2020-1391)

The version of libarchive installed on the remote host is prior to 3.1.2-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1391 advisory. archivereadformatrarreaddata in archivereadsupportformatrar.c in libarchive before 3.4.0 has a use-after-free in a certain...

Amazon Linux 2 : kernel (ALAS-2020-1392)

The version of kernel installed on the remote host is prior to 4.14.165-131.185. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1392 advisory. 2024-05-09: CVE-2019-19965 was added to this advisory. A flaw was found in the Linux kernel. The cryptoreport...

Amazon Linux 2 : python-pip (ALAS-2020-1389)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1389 advisory. In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. CVE-2019-11236 The urllib3 library before 1.24.2 for Python mishandles...

Important: thunderbird

Issue Overview: When pasting a tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR tag from the clipboard into...

Amazon Linux 2 : systemd (ALAS-2020-1388)

The version of systemd installed on the remote host is prior to 219-57. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1388 advisory. A heap use-after-free vulnerability was found in systemd, where asynchronous Polkit queries are performed while handling dbus...

Amazon Linux AMI : kernel (ALAS-2020-1338)

The version of kernel installed on the remote host is prior to 4.14.165-102.185. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1338 advisory. 2024-05-09: CVE-2019-19965 was added to this advisory. A flaw was found in the Linux kernel. The cryptoreport...

Important: libarchive

Issue Overview: archivereadformatrarreaddata in archivereadsupportformatrar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVEFAILED situation, related to Ppmd7DecodeSymbol. CVE-2019-18408 Affected Packages: libarchive Note: This advisory is applicable to Amazon Linux 2 AL2 Co...

Important: kernel

Issue Overview: A flaw was found in the Linux kernel. The cryptoreport function mishandles resource cleanup on error. A local attacker able to induce the error conditions could use this flaw to crash the system. The highest threat from this vulnerability is to system availability. CVE-2019-19062 ...

Medium: python-pip

Issue Overview: In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. CVE-2019-11236 The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store...

Medium: systemd

Issue Overview: A heap use-after-free vulnerability was found in systemd, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending...

Amazon Linux 2 : thunderbird (ALAS-2020-1386)

The version of thunderbird installed on the remote host is prior to 68.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1386 advisory. The plain text serializer used a fixed-size array for the number of Under certain conditions, when checking the Resis...

Amazon Linux 2 : nss (ALAS-2020-1384)

The version of nss installed on the remote host is prior to 3.44.0-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1384 advisory. A heap-based buffer overflow was found in the NSCEncryptUpdate function in Mozilla nss. A remote attacker could trigger this...

Amazon Linux 2 : 389-ds-base (ALAS-2020-1381)

The version of 389-ds-base installed on the remote host is prior to 1.3.9.1-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1381 advisory. A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values...