Amazon Linux AMI : tomcat8 (ALAS-2023-1732)

The version of tomcat8 installed on the remote host is prior to 8.5.87-1.92. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1732 advisory. The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47...

Amazon Linux AMI : curl (ALAS-2023-1729)

The version of curl installed on the remote host is prior to 7.61.1-12.104. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1729 advisory. A vulnerability was found in curl. In this issue, curl can be asked to tunnel all protocols virtually it supports throug...

Amazon Linux AMI : jasper (ALAS-2023-1733)

The version of jasper installed on the remote host is prior to 1.900.1-21.12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1733 advisory. A flaw was found in the Jasper tool's jpc encoder. This flaw allows an attacker to craft input provided to Jasper,...

Amazon Linux AMI : golang (ALAS-2023-1731)

The version of golang installed on the remote host is prior to 1.18.6-1.43. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1731 advisory. Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working...

Amazon Linux AMI : dbus (ALAS-2023-1730)

The version of dbus installed on the remote host is prior to 1.6.12-14.31. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1730 advisory. An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An...

Amazon Linux AMI : curl (ALAS-2023-1727)

The version of curl installed on the remote host is prior to 7.61.1-12.105. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1727 advisory. The curl advisory describes this issue as follows: curl supports communicating using the TELNET protocol and as a part o...

CVE-2023-28863

AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity...

CVE-2023-28863

AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity...

CVE-2023-28863

Summary: CVE-2023-28863 affects AMI MegaRAC SPx12/SPx13 IPMI implementations. The issue is Insufficient Verification of Data Authenticity in IPMI 2.0 negotiation, allowing an attacker with network access to bypass negotiated integrity/confidentiality. Affected platforms include iSeries variants (...

Amazon Linux AMI : python-twisted-web (ALAS-2023-1717)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1717 advisory. A flaw was found in python-twisted. This vulnerability occurs due to the parsing of illegal constructs in the twisted.web.http module. The illegal constructs include '+/-' in the Content-Length...

Amazon Linux AMI : exim (ALAS-2023-1722)

The version of exim installed on the remote host is prior to 4.92-1.36. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1722 advisory. The STARTTLS feature in Exim through 4.94.2 allows response injection buffering during MTA SMTP sending. CVE-2021-38371 Tenable has...

Amazon Linux AMI : yasm (ALAS-2023-1724)

The version of yasm installed on the remote host is prior to 1.2.0-1.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1724 advisory. An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasmexprgetintnum in libyasm/expr.c...

Amazon Linux AMI : microcode_ctl (ALAS-2023-1715)

The version of microcodectl installed on the remote host is prior to 2.1-47.41. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1715 advisory. 2024-02-14: CVE-2022-38090 was added to this advisory. 2024-02-01: CVE-2022-21216 was added to this advisory...

Amazon Linux AMI : python-babel (ALAS-2023-1720)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1720 advisory. Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files containing serialized Python objects via directory traversal, leading to code execution. CVE-2021-42771 Tenable has...

Amazon Linux AMI : db4 (ALAS-2023-1726)

The version of db4 installed on the remote host is prior to 4.7.25-22.13. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1726 advisory. Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges ...

Amazon Linux AMI : sssd (ALAS-2023-1723)

The version of sssd installed on the remote host is prior to 1.16.4-21.27. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1723 advisory. A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs- fetch and...

Amazon Linux AMI : ghostscript (ALAS-2023-1725)

The version of ghostscript installed on the remote host is prior to 8.70-24.27. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1725 advisory. A heap-based buffer over write vulnerability was found in GhostScript's lp8000printpage function in gdevlp8k.c file. An...

Amazon Linux AMI : openvpn (ALAS-2023-1719)

The version of openvpn installed on the remote host is prior to 2.4.12-1.43. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1719 advisory. OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of...

Amazon Linux AMI : gd (ALAS-2023-1721)

The version of gd installed on the remote host is prior to 2.0.35-11.11. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1721 advisory. DISPUTED gdImageGd2Ptr in gdgd2.c in the GD Graphics Library aka LibGD through 2.3.2 has a double free. NOTE: the vendor's position ...

Amazon Linux AMI : emacs (ALAS-2023-1712)

The version of emacs installed on the remote host is prior to 24.3-20.25. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1712 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file,...