Important: Red Hat Enhancement Advisory: Red Hat OpenShift Service on AWS 1.0 enhancements

A new Red Hat OpenShift Service on AWS package is available for Red Hat Enterprise Linux 8. Red Hat OpenShift Service on AWS is a fully-managed OpenShift service, jointly managed and supported by both Red Hat and Amazon Web Services AWS. Having your clusters maintained by this service gives you t...

Amazon Linux 2 : kernel, --advisory ALAS2-2025-2837 (ALAS-2025-2837)

The version of kernel installed on the remote host is prior to 4.14.305-227.531. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2837 advisory. In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix double increment of clientcount...

Amazon Linux 2 : kernel (ALAS-2025-2834)

The version of kernel installed on the remote host is prior to 4.14.330-250.540. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2834 advisory. A use-after-free flaw was found in vcsread in drivers/tty/vt/vcscreen.c in vcscreen in the Linux Kernel. In this...

Amazon Linux 2 : nss-softokn (ALAS-2025-2835)

The version of nss-softokn installed on the remote host is prior to 3.67.0-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2835 advisory. new tlsfuzzer code can still detect timing issues in RSA operations CVE-2023-4421 Tenable has extracted the preceding...

Important: libsoup

Issue Overview: A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skipinsightwhitespace function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server. CVE-2025-2784 Affected Packages...

Amazon Linux 2 : grub2 (ALAS-2025-2844)

The version of grub2 installed on the remote host is prior to 2.06-14. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2844 advisory. When reading the language .mo file in grubmofileopen, grub2 fails to verify an integer overflow when allocating its internal...

Amazon Linux 2 : libsoup (ALAS-2025-2841)

The version of libsoup installed on the remote host is prior to 2.56.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2841 advisory. A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the...

Amazon Linux AMI : kernel (ALAS-2025-1973)

The version of kernel installed on the remote host is prior to 4.14.355-196.639. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2025-1973 advisory. A use-after-free flaw was found in btrfssearchslot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allow...

Medium: qt

Issue Overview: In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont munitsPerEm initialization is mishandled. CVE-2023-32573 Affected Packages: qt Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ secti...

Important: libsoup

Issue Overview: A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skipinsightwhitespace function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server. CVE-2025-2784 Affected Packages...

Amazon Linux 2 : python-requests (ALAS-2025-2845)

The version of python-requests installed on the remote host is prior to 2.6.0-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2845 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

Amazon Linux 2 : python3-requests (ALAS-2025-2846)

The version of python3-requests installed on the remote host is prior to 2.14.2-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2846 advisory. Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is mad...

Medium: python3-requests

Issue Overview: Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to th...

Low: python-requests

Issue Overview: No CVE associated with this advisory Affected Packages: python-requests Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update python-requests t...

Medium: grub2

Issue Overview: When reading the language .mo file in grubmofileopen, grub2 fails to verify an integer overflow when allocating its internal buffer. A crafted .mo file may lead the buffer size calculation to overflow, leading to out-of-bound reads and writes. This flaw allows an attacker to leak...

Important: kernel

Issue Overview: A use-after-free flaw was found in vcsread in drivers/tty/vt/vcscreen.c in vcscreen in the Linux Kernel. In this flaw an attacker with local user access may lead to a system crash or a leak of internal kernel information. CVE-2023-3567 In the Linux kernel, the following...

Low: python-requests

Issue Overview: No CVE associated with this advisory Affected Packages: python-requests Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update python-requests o...

Medium: python3-requests

Issue Overview: Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to th...

Amazon Linux 2 : java-17-amazon-corretto (ALAS-2025-2838)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.15+6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2838 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product...

Amazon Linux 2 : kernel (ALAS-2025-2843)

The version of kernel installed on the remote host is prior to 4.14.355-276.639. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2843 advisory. In the Linux kernel, the following vulnerability has been resolved: nbd: Fix NULL pointer in flushworkqueue...