Amazon Linux 2 : yajl (ALAS-2023-2182)

The version of yajl installed on the remote host is prior to 2.0.4-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2182 advisory. There's a memory leak in yajl 2.1.0 with use of yajltreeparse function. which will cause out-of-memory in server and cause crash...

Amazon Linux 2023 : openssh, openssh-clients, openssh-keycat (ALAS2023-2023-273)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-273 advisory. The PKCS11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if the target user's ssh-agent is forwarded to an...

Amazon Linux 2023 : bouncycastle, bouncycastle-javadoc, bouncycastle-mail (ALAS2023-2023-280)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-280 advisory. A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence o...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-285)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-285 advisory. 2023-08-31: CVE-2023-3611 was removed from this advisory. 2023-08-31: CVE-2023-3776 was removed from this advisory. 2023-08-31: The severity of this advisory was changed from important to mediu...

Amazon Linux 2023 : iperf3, iperf3-devel (ALAS2023-2023-274)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-274 advisory. iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. CVE-2023-38403 Tenable has extracted the preceding description block directly from the tested...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2023-1798)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.372.b07-1.76. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1798 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component:...

Amazon Linux 2023 : yajl, yajl-devel (ALAS2023-2023-279)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-279 advisory. There's a memory leak in yajl 2.1.0 with use of yajltreeparse function. which will cause out-of-memory in server and cause crash. CVE-2023-33460 Tenable has extracted the preceding description block...

Amazon Linux 2 : linux-firmware (ALAS-2023-2190)

The version of linux-firmware installed on the remote host is prior to 20200421-81.git78c0348. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2190 advisory. An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially...

Amazon Linux 2 : cups (ALAS-2023-2184)

The version of cups installed on the remote host is prior to 1.6.3-51. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2184 advisory. OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-287)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-287 advisory. A Gather Data Sampling GDS transient execution side-channel vulnerability was found affecting certain Intel processors. This issue may allow a local attacker using gather instruction load from memory to...

Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2023-025)

The version of runc installed on the remote host is prior to 1.1.7-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2023-025 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject...

Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2023-005)

The version of java-11-openjdk installed on the remote host is prior to 11.0.20.0.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2JAVA-OPENJDK11-2023-005 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK...

Amazon Linux AMI : ca-certificates (ALAS-2023-1795)

The version of ca-certificates installed on the remote host is prior to 2018.2.22-65.1.30. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1795 advisory. An initial fix in Amazon Linux ca-certificates package relating to CVE-2022-23491 did not properly remove root...

Amazon Linux AMI : kernel (ALAS-2023-1792)

The version of kernel installed on the remote host is prior to 4.14.320-169.544. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1792 advisory. A use-after-free vulnerability in the Linux kernel's net/sched: clsu32 component can be exploited to achieve local...

Amazon Linux AMI : python-ecdsa (ALAS-2023-1800)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1800 advisory. An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions or no exceptions at all, which could...

Amazon Linux AMI : GraphicsMagick (ALAS-2023-1799)

The version of GraphicsMagick installed on the remote host is prior to 1.3.32-1.17. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1799 advisory. In GraphicsMagick, a heap buffer overflow was found when parsing MIFF. CVE-2022-1270 Tenable has extracted the preceding...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-050)

The version of kernel installed on the remote host is prior to 5.4.250-166.369. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-050 advisory. An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to...

Amazon Linux 2023 : grpc, grpc-cpp, grpc-data (ALAS2023-2023-282)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-282 advisory. 2023-10-12: CVE-2023-4785 was added to this advisory. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table...

Amazon Linux 2 : wireshark (ALAS-2023-2187)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2187 advisory. VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-277)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-277 advisory. Kafka dissector crash in Wireshark 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 allows denial of service via packet injection or crafted capture file CVE-2023-3648 iSCSI dissector crash in Wireshark 4.0....