Amazon Linux 2023 : libwebp, libwebp-devel, libwebp-java (ALAS2023-2023-355)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-355 advisory. With a specially crafted WebP lossless file, libwebp may write data out of bounds to the heap. The ReadHuffmanCodes function allocates the HuffmanCode buffer with a size that comes from an array of...

Amazon Linux 2023 : nerdctl (ALAS2023-2023-366)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-366 advisory. Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. CVE-2023-3978 Tenable has extracted the precedi...

Amazon Linux 2 : mod_wsgi (ALASHTTPD_MODULES-2023-001)

It is, therefore, affected by a vulnerability as referenced in the ALAS2HTTPDMODULES-2023-001 advisory. A vulnerability was found in modwsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI...

Amazon Linux 2 : hiredis (ALASREDIS6-2023-004)

The version of hiredis installed on the remote host is prior to 0.13.3-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2REDIS6-2023-004 advisory. Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer...

Amazon Linux 2 : libpq (ALASPOSTGRESQL12-2023-003)

The version of libpq installed on the remote host is prior to 12.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL12-2023-003 advisory. 2024-02-29: CVE-2021-23222 was added to this advisory. A man-in-the-middle attacker can inject false responses to...

Amazon Linux 2 : ruby (ALASRUBY3.0-2023-004)

The version of ruby installed on the remote host is prior to 3.0.5-155. It is, therefore, affected by a vulnerability as referenced in the ALAS2RUBY3.0-2023-004 advisory. The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is releva...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2023-006)

The version of tomcat installed on the remote host is prior to 9.0.54-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2023-006 advisory. A memory leak flaw was found in Apache Tomcat, where an HTTP upgrade connection does not release for WebSocket connections on...

Amazon Linux 2 : ansible (ALASANSIBLE2-2023-003)

The version of ansible installed on the remote host is prior to 2.9.20-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ANSIBLE2-2023-003 advisory. A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in...

Amazon Linux 2 : libsepol (ALASSELINUX-NG-2023-001)

The version of libsepol installed on the remote host is prior to 2.5-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2SELINUX-NG-2023-001 advisory. The CIL compiler in SELinux 3.2 has a use-after-free in cilverifyclassperms called from cilverifyclasspermission...

Amazon Linux 2 : haproxy2 (ALASHAPROXY2-2023-005)

The version of haproxy2 installed on the remote host is prior to 2.2.17-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2HAPROXY2-2023-005 advisory. A flaw was found in haproxy. An input validation flaw when processing HTTP/2 requests causes haproxy to not ensur...

Amazon Linux 2 : python-httplib2 (ALASANSIBLE2-2023-007)

It is, therefore, affected by a vulnerability as referenced in the ALAS2ANSIBLE2-2023-007 advisory. A flaw was found in python-httplib2. An attacker controlling an unescaped part of uri for httplib2.Http.request could change request headers and body, send additional hidden requests to same server...

Amazon Linux 2 : djvulibre (ALASMATE-DESKTOP1.X-2023-002)

The version of djvulibre installed on the remote host is prior to 3.5.27-28. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2MATE-DESKTOP1.X-2023-002 advisory. A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds write in function DJVU::filterbv via...

Amazon Linux 2 : ecs-service-connect-agent, --advisory ALAS2ECS-2023-007 (ALASECS-2023-007)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.27.0.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-007 advisory. Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1,...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-003)

The version of tomcat installed on the remote host is prior to 8.5.79-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT8.5-2023-003 advisory. A flaw was found in the Apache Tomcat package. An example web application did not filter the form authentication example,...

Amazon Linux 2 : redis (ALASREDIS6-2023-006)

The version of redis installed on the remote host is prior to 6.2.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2REDIS6-2023-006 advisory. Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can b...

Amazon Linux 2 : ruby (ALASRUBY2.6-2023-005)

The version of ruby installed on the remote host is prior to 2.6.7-126. It is, therefore, affected by a vulnerability as referenced in the ALAS2RUBY2.6-2023-005 advisory. An operating system command injection flaw was found in RDoc. Using the rdoc command to generate documentation for a malicious...

Amazon Linux 2 : python38 (ALASPYTHON3.8-2023-008)

The version of python38 installed on the remote host is prior to 3.8.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PYTHON3.8-2023-008 advisory. A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an infinite...

Amazon Linux 2 : squid (ALASSQUID4-2023-002)

The version of squid installed on the remote host is prior to 4.15-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2SQUID4-2023-002 advisory. A flaw was found in squid. A trusted client can directly access the cache manager information, bypassing the manager ACL protecti...

Amazon Linux 2 : haproxy2 (ALASHAPROXY2-2023-001)

The version of haproxy2 installed on the remote host is prior to 2.2.17-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2HAPROXY2-2023-001 advisory. A flaw was found in the way HAProxy processed HTTP responses containing the Set-Cookie2 header. This flaw could allow an...

Amazon Linux 2 : ruby (ALASRUBY3.0-2023-002)

The version of ruby installed on the remote host is prior to 3.0.4-155. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2RUBY3.0-2023-002 advisory. A double-free vulnerability was found in Ruby. The issue occurs during Regexp compilation. This flaw allows an attack...