Amazon Linux 2 : python-twisted-web (ALAS-2020-1428)

The version of python-twisted-web installed on the remote host is prior to 12.1.0-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1428 advisory. In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a...

Amazon Linux 2 : httpd (ALAS-2020-1427)

The version of httpd installed on the remote host is prior to 2.4.43-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1427 advisory. In Apache HTTP Server 2.4.0 to 2.4.41, modproxyftp may use uninitialized memory when proxying to a malicious FTP server...

Amazon Linux 2 : unbound (ALAS-2020-1430)

The version of unbound installed on the remote host is prior to 1.6.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1430 advisory. infinite loop via malformed DNS answers received from upstream servers CVE-2020-12663 insufficient control of network...

Amazon Linux 2 : bind (ALAS-2020-1426)

The version of bind installed on the remote host is prior to 9.11.4-9.P2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1426 advisory. An assertion failure was found in BIND, which checks the validity of messages containing TSIG resource records. This flaw...

Important: unbound

Issue Overview: infinite loop via malformed DNS answers received from upstream servers CVE-2020-12663 insufficient control of network message volume leads to DoS CVE-2020-12662 Affected Packages: unbound Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ secti...

Amazon Linux AMI : dovecot (ALAS-2020-1363)

The version of dovecot installed on the remote host is prior to 2.2.36-6.19. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1363 advisory. In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker...

Amazon Linux AMI : expat (ALAS-2020-1364)

The version of expat installed on the remote host is prior to 2.1.0-11.22. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1364 advisory. Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows...

Amazon Linux AMI : php73 (ALAS-2020-1368)

The version of php73 installed on the remote host is prior to 7.3.17-1.25. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1368 advisory. In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while parsing EXIF data with exifreaddata...

Amazon Linux AMI : php72 (ALAS-2020-1367)

The version of php72 installed on the remote host is prior to 7.2.30-1.22. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1367 advisory. In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while parsing EXIF data with exifreaddata...

Amazon Linux AMI : kernel (ALAS-2020-1366)

The version of kernel installed on the remote host is prior to 4.14.177-107.254. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1366 advisory. A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem. This flaw occurs while importing...

Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2020-1365)

The version of java-1.7.0-openjdk installed on the remote host is prior to 1.7.0.261-2.6.22.1.83. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1365 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...

Amazon Linux 2 : ipa (ALAS-2020-1423)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1423 advisory. A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function berscanf was used in some component...

Amazon Linux 2 : java-1.7.0-openjdk (ALAS-2020-1424)

The version of java-1.7.0-openjdk installed on the remote host is prior to 1.7.0.261-2.6.22.2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1424 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...

Amazon Linux 2 : kernel (ALAS-2020-1425)

The version of kernel installed on the remote host is prior to 4.14.177-139.254. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1425 advisory. A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem. This flaw occurs while importing the...

Important: ipa

Issue Overview: A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function berscanf was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who...

Amazon Linux 2 : git (ALAS-2020-1416)

The version of git installed on the remote host is prior to 2.23.3-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1416 advisory. Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an...

Amazon Linux 2 : icu (ALAS-2020-1418)

The version of icu installed on the remote host is prior to 50.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1418 advisory. An issue was discovered in International Components for Unicode ICU for C/C++ through 66.1. An integer overflow, leading to a heap-based...

Amazon Linux 2 : http-parser (ALAS-2020-1417)

The version of http-parser installed on the remote host is prior to 2.7.1-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1417 advisory. HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed...

Amazon Linux 2 : telnet (ALAS-2020-1422)

The version of telnet installed on the remote host is prior to 0.17-65. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1422 advisory. utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2020-1421)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.252.b09-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1421 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...