High Availability Setup on Amazon Web Service

This article describes the design perspective of High Availability HAon Amazon Web Service AWS environment. Background AWS does not support Gratuitous Address Resolution Protocol GARP, Virtual Local Area Network VLAN or any Layer-2 L2 functionalities like bridging. Two virtual machines belonging ...

Malicious code in python-aliyun-sdk-rds (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 56906386c88b620607253fc1d00a6d5d205c6a535a2ba12fc63108f09761300b Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

Malicious code in tencentcloud-python-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c79d20c4af5b69c3506d69fb847d2f5306a83433cb56e391c8dbf828e9728319 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

Malicious code in aliyun-oss2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8c33f6b28da216b43120a3b8a8537d0263dc1eb2b22979a4183b371ff57b9e0b Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2023-291)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-291 advisory. A heap-based buffer overflow flaw was found in Redis. This flaw allows an attacker to trick an authenticated user into executing a specially crafted Lua script in Redis. This attack triggers a heap...

Amazon Linux 2 : python-configobj (ALAS-2023-2188)

The version of python-configobj installed on the remote host is prior to 4.7.2-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2188 advisory. All versions of the package configobj are vulnerable to Regular Expression Denial of Service ReDoS via the validate...

Amazon Linux 2023 : avahi, avahi-autoipd, avahi-compat-howl (ALAS2023-2023-272)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-272 advisory. A reachable assertion was found in avahidnspacketappendrecord. CVE-2023-38469 A reachable assertion was found in avahiescapelabel. CVE-2023-38470 A reachable assertion was found in...

Amazon Linux 2023 : libnghttp2, libnghttp2-devel, nghttp2 (ALAS2023-2023-278)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-278 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY fram...

Amazon Linux AMI : ImageMagick (ALAS-2023-1791)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1.27. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1791 advisory. A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel function in quantum- private.h. This issue ma...

Amazon Linux 2 : ImageMagick (ALAS-2023-2178)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2178 advisory. A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel function in quantum- private.h. This issue may...

Amazon Linux AMI : nghttp2 (ALAS-2023-1793)

The version of nghttp2 installed on the remote host is prior to 1.33.0-1.1.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1793 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

Amazon Linux 2023 : pcre2, pcre2-devel, pcre2-static (ALAS2023-2023-286)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-286 advisory. Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. CVE-2022-41409 Tenable has extracted the preceding...

Amazon Linux 2023 : poppler, poppler-cpp, poppler-cpp-devel (ALAS2023-2023-289)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-289 advisory. Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder JBIG2Stream::readTextRegionSeg in JBIGStream.cc. Processing a specially crafted PDF file or JBIG2 image could lea...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-290)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-290 advisory. Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrusted user data is provided as a range...

Amazon Linux 2 : golang (ALAS-2023-2186)

The version of golang installed on the remote host is prior to 1.20.6-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2186 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional...

Amazon Linux 2 : webkitgtk4 (ALAS-2023-2177)

The version of webkitgtk4 installed on the remote host is prior to 2.38.5-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2177 advisory. A vulnerability was found in webkitgtk. This issue occurs when processing web content, which may lead to arbitrary code...

Amazon Linux 2023 : bouncycastle, bouncycastle-javadoc, bouncycastle-mail (ALAS2023-2023-280)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-280 advisory. A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence o...

Amazon Linux 2 : nghttp2 (ALAS-2023-2180)

The version of nghttp2 installed on the remote host is prior to 1.41.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2180 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

Amazon Linux 2 : cni-plugins (ALAS-2023-2192)

The version of cni-plugins installed on the remote host is prior to 1.2.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2192 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Tenable has extracted the preceding description block...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-038)

The version of kernel installed on the remote host is prior to 5.10.186-179.751. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-038 advisory. 2024-07-03: CVE-2023-3389 was added to this advisory. 2023-08-31: CVE-2023-20569 was added to this...