Medium: opensc

Issue Overview: A vulnerability was found in OpenSC where PKCS1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data. CVE-2023-5992 Affected Packages: opensc Note: This advisory is applicable to Amazon Linux 2 AL2 Cor...

Important: kernel-livepatch-4.14.336-257.562

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: exthdr: fix 4-byte stack OOB write If priv-len is a multiple of 4, then dstlen / 4 can write past the destination array which leads to stack corruption. This construct is necessary to clean th...

Amazon Linux 2 : kernel (ALAS-2024-2569)

The version of kernel installed on the remote host is prior to 4.14.276-211.499. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2569 advisory. In the Linux kernel, the following vulnerability has been resolved: ubi: Fix race condition between ctrlcdevioctl...

Amazon Linux 2 : cri-tools (ALAS-2024-2568)

The version of cri-tools installed on the remote host is prior to 1.29.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2568 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of...

Malicious code in aws-public (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b192498364ed7190f44f00a98983087f969407bd217eadfed1c6353335eda7f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2024-071 (ALASKERNEL-5.4-2024-071)

The version of kernel installed on the remote host is prior to 5.4.226-129.415. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-071 advisory. A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-044)

The version of kernel installed on the remote host is prior to 5.15.160-104.158. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-044 advisory. In the Linux kernel, the following vulnerability has been resolved: md: fix kmemleak of rdev-serial...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL14-2024-011)

The version of postgresql installed on the remote host is prior to 14.12-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2024-011 advisory. postgresql: PostgreSQL pgstatsext and pgstatsextexprs lack authorization checks CVE-2024-4317 Tenable has extracted t...

Amazon Linux 2 : firefox (ALASFIREFOX-2024-025)

The version of firefox installed on the remote host is prior to 115.11.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2024-025 advisory. A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2024-059 (ALASKERNEL-5.10-2024-059)

The version of kernel installed on the remote host is prior to 5.10.176-157.645. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-059 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: block range must be validated...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2024-070 (ALASKERNEL-5.4-2024-070)

The version of kernel installed on the remote host is prior to 5.4.238-148.347. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-070 advisory. An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x8664 lacks...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-639)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-639 advisory. 2024-07-03: CVE-2024-26605 was added to this advisory. 2024-07-03: CVE-2024-35995 was added to this advisory. In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix...

Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2024-635)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-635 advisory. postgresql: PostgreSQL pgstatsext and pgstatsextexprs lack authorization checks CVE-2024-4317 Tenable has extracted the preceding description block directly from the tested product security advisory. No...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2024-640)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-640 advisory. Issue summary: Some non-default TLS server configurations can cause unboundedmemory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to...

Amazon Linux 2023 : unixODBC, unixODBC-devel (ALAS2023-2024-641)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-641 advisory. An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2024-637)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-637 advisory. NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.htmlNOTE: https://cgit.ghostscript.com/cgi- bin/cgit.cgi/ghostpdl.git/commit/?id=7145885041bb52cc23964f0aa2aec1b1c82b5908 ghostpdl-10.03.1NOTE:...

Amazon Linux 2023 : libRmath, libRmath-devel, libRmath-static (ALAS2023-2024-638)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-638 advisory. Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling a maliciously crafted RDS R Data...

Amazon Linux 2023 : nasm, nasm-rdoff (ALAS2023-2024-642)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-642 advisory. Null pointer dereference in ieeewritefile in nasm 2.16rc0 allows attackers to cause a denial of service crash. CVE-2023-38665 Tenable has extracted the preceding description block directly from the test...

Amazon Linux 2023 : bouncycastle, bouncycastle-javadoc, bouncycastle-mail (ALAS2023-2024-636)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-636 advisory. An issue was discovered in Bouncy Castle Java Cryptography APIs before ... NOTE: https://github.com/bcgit/bc-java/issues/1635NOTE: https://www.bouncycastle.org/latestreleases.htmlDEBIANBUG:...

CVE-2024-37163 SkyScrape Secure API Requests

SkyScrape is a GUI Dashboard for AWS Infrastructure and Managing Resources and Usage Costs. SkyScrape's API requests are currently unsecured HTTP requests, leading to potential vulnerabilities for the user's temporary credentials and data. This affects version 1.0.0...