Amazon Linux 2 : nginx (ALASNGINX1-2023-003)

The version of nginx installed on the remote host is prior to 1.20.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2023-003 advisory. A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot characte...

Amazon Linux 2 : ruby (ALASRUBY2.6-2023-006)

The version of ruby installed on the remote host is prior to 2.6.7-126. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2RUBY2.6-2023-006 advisory. An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL11-2023-002)

The version of postgresql installed on the remote host is prior to 11.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL11-2023-002 advisory. A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL11-2023-003)

The version of postgresql installed on the remote host is prior to 11.12-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL11-2023-003 advisory. A flaw was found in postgresql. While modifying certain SQL array values, missing bounds checks let...

Amazon Linux 2 : haproxy2 (ALASHAPROXY2-2023-006)

The version of haproxy2 installed on the remote host is prior to 2.1.4-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2HAPROXY2-2023-006 advisory. In hpackdhtinsert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write...

Amazon Linux 2 : redis (ALASREDIS6-2023-003)

The version of redis installed on the remote host is prior to 6.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2023-003 advisory. A flaw was found in the Redis database where Lua scripts can be manipulated to overcome ACL rules. This flaw allows an...

Amazon Linux 2 : golang (ALASGOLANG1.19-2023-002)

The version of golang installed on the remote host is prior to 1.19.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2GOLANG1.19-2023-002 advisory. An out of bounds read vulnerability was found in debug/macho of the Go standard library. When using the debug/mac...

Amazon Linux 2 : redis (ALASREDIS6-2023-001)

The version of redis installed on the remote host is prior to 6.2.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2023-001 advisory. Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted SETRANGE and SORTR...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-011)

The version of tomcat installed on the remote host is prior to 8.5.58-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT8.5-2023-011 advisory. If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the...

Amazon Linux 2 : mariadb (ALASMARIADB10.5-2023-004)

The version of mariadb installed on the remote host is prior to 10.5.10-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2MARIADB10.5-2023-004 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are...

Amazon Linux 2 : python38 (ALASPYTHON3.8-2023-004)

The version of python38 installed on the remote host is prior to 3.8.15-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PYTHON3.8-2023-004 advisory. The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that...

Amazon Linux 2 : ruby (ALASRUBY3.0-2023-006)

The version of ruby installed on the remote host is prior to 3.0.1-148. It is, therefore, affected by a vulnerability as referenced in the ALAS2RUBY3.0-2023-006 advisory. An operating system command injection flaw was found in RDoc. Using the rdoc command to generate documentation for a malicious...

Amazon Linux 2 : python38-setuptools (ALASPYTHON3.8-2023-003)

The version of python38-setuptools installed on the remote host is prior to 38.4.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2PYTHON3.8-2023-003 advisory. Python Packaging Authority PyPA setuptools before 65.5.1 allows remote attackers to cause a denial of service...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2023-002)

The version of postgresql installed on the remote host is prior to 13.7-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL13-2023-002 advisory. 2024-08-28: CVE-2021-3677 was added to this advisory. 2024-02-29: CVE-2021-23222 was added to this advisory. ...

Amazon Linux 2 : haproxy2 (ALASHAPROXY2-2023-007)

The version of haproxy2 installed on the remote host is prior to 2.2.17-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2HAPROXY2-2023-007 advisory. HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2023-008)

The version of tomcat installed on the remote host is prior to 9.0.73-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2023-008 advisory. A privilege escalation flaw was found in Tomcat when the JMX Remote Lifecycle Listener was enabled. A local attacker...

Scylla Security Breach

Scylla is a ScyllaDB open source real-time big data database compatible with Apache Cassandra and Amazon DynamoDB APIs. Scylla has a security vulnerability that stems from allowing an attacker with CREATE access to elevate to higher privileges...

Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2023-005 (ALASTOMCAT9-2023-005)

The version of tomcat installed on the remote host is prior to 9.0.65-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2023-005 advisory. The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards...

Amazon Linux 2 : python-paramiko (ALASANSIBLE2-2023-002)

It is, therefore, affected by a vulnerability as referenced in the ALAS2ANSIBLE2-2023-002 advisory. In Paramiko before 2.10.1, a race condition between creation and chmod in the writeprivatekeyfile function could allow unauthorized information disclosure. CVE-2022-24302 Tenable has extracted the...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2023-003)

The version of postgresql installed on the remote host is prior to 13.3-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL13-2023-003 advisory. A flaw was found in postgresql. While modifying certain SQL array values, missing bounds checks let...