PT-2023-36251 · Amazon · Amazon-Ssm-Agent

Name of the Vulnerable Software and Affected Versions: amazon-ssm-agent affected versions not specified Description: The issue is related to a security concern addressed by rebuilding the package with the go 1.21 security release. Recommendations: At the moment, there is no information about a...

Advisory ROSA-SA-2023-2223

Software: nss 3.53.1 OS: ROSA Virtualization 2.1 packageevrstring: nss-3.53.1-17.rv3.1c.src.rpm CVE-ID: CVE-2020-12403 BDU-ID: None CVE-Crit: CRITICAL CVE-DESC.: A bug was discovered in the way CHACHA20-POLY1305 is implemented in NSS in versions prior to 3.55. When using a Chacha20 consisting of...

Important: nerdctl

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send...

Important: runc

Issue Overview: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

Medium: amazon-cloudwatch-agent

Issue Overview: 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192...

Low: gawk

Issue Overview: A heap out-of-bounds read flaw was found in builtin.c in the gawk package which may result in a crash of the software. CVE-2023-4156 Affected Packages: gawk Issue Correction: Run dnf update gawk --releasever 2023.1.20230825 or dnf update --advisory ALAS2023-2023-292 --releasever...

Medium: libtiff

Issue Overview: LibTIFF 4.4.0 has an out-of-bounds write in TIFFmemcpy in libtiff/tifunix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available...

Important: libqb

Issue Overview: logblackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered. CVE-2023-39976 Affected Packages: libqb Issue Correction: Run dnf update libqb --releasever 2023.1.20230825 or dnf update --advisory ALAS2023-2023-294...

Why Your AWS Cloud Container Needs Client-Side Security

With increasingly complicated network infrastructure and organizations needing to deploy applications across various environments, cloud containers are necessary for companies to stay agile and innovative. Containers are packages of software that hold all of the necessary components for an app to...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2023-310)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-310 advisory. 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fi...

Amazon Linux 2023 : ca-certificates (ALAS2023-2023-297)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-297 advisory. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2023-296)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-296 advisory. 2024-02-15: CVE-2020-21710 was added to this advisory. A divide by zero issue discovered in epsprintpage in gdevepsn.c in Artifex Software GhostScript 9.50 allows remote attackers to cause a...

Amazon Linux 2023 : doxygen2man, libqb, libqb-devel (ALAS2023-2023-294)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-294 advisory. logblackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered. CVE-2023-39976 Tenable has extracted the preceding description block directl...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-316)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-316 advisory. When doing NTLM authentication, the client sends replies tocryptographic challenges back to the server. These replieshave variable length. Winbind did not properly bounds-checkthe lan manager...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-306)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-306 advisory. Issue summary: The AES-SIV cipher implementation contains a bug that causesit to ignore empty associated data entries which are unauthenticated asa consequence. Impact summary: Applications tha...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-314)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-314 advisory. 2024-05-09: CVE-2022-3597 was added to this advisory. LibTIFF 4.4.0 has an out-of-bounds write in TIFFmemcpy in libtiff/tifunix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826...

Amazon Linux 2023 : guava, guava-javadoc, guava-testlib (ALAS2023-2023-305)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-305 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Amazon Linux 2023 : jsoup, jsoup-javadoc (ALAS2023-2023-315)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-315 advisory. jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting XSS safety. jsoup may incorrectly sanitize HTML including javascript: URL expressions, which could allow...

Amazon Linux 2023 : php8.1, php8.1-bcmath, php8.1-cli (ALAS2023-2023-303)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-303 advisory. GHSA-76gg-c692-v2mw: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP NOTE: Fixed in 8.2.7, 8.1.20, 8.0.29NOTE: https://github.com/php/php-...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-298)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-298 advisory. A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tiffax3.c, resulting in a denial of service...