Amazon Linux AMI : busybox (ALAS-2021-1496)

The version of busybox installed on the remote host is prior to 1.19.3-2.12. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1496 advisory. decompressgunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huftbuild result pointer, with a resultant invalid...

Amazon Linux AMI : python35 (ALAS-2021-1498)

The version of python35 installed on the remote host is prior to 3.5.10-1.30. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1498 advisory. The package python/cpython is vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by...

Amazon Linux AMI : nvidia (ALAS-2021-1495)

The version of nvidia installed on the remote host is prior to 418.197.02-2018.03.117. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1495 advisory. NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer nvlddmkm.sys or...

Amazon Linux AMI : tomcat7 (ALAS-2021-1493)

The version of tomcat7 installed on the remote host is prior to 7.0.108-1.40. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1493 advisory. A deserialization flaw was discovered in Apache Tomcat's use of a FileStore. Under specific circumstances, an attacker...

Amazon Linux AMI : screen (ALAS-2021-1492)

The version of screen installed on the remote host is prior to 4.0.3-19.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1492 advisory. A flaw was found in screen. A specially crafted sequence of combining characters could cause an out of bounds write leading to...

Amazon Linux AMI : git (ALAS-2021-1490)

The version of git installed on the remote host is prior to 2.18.5-2.73. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1490 advisory. Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains...

Amazon Linux AMI : php72, php73 (ALAS-2020-1425)

The version of php72 installed on the remote host is prior to 7.2.33-1.25. The version of php73 installed on the remote host is prior to 7.3.21-1.28. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1425 advisory. The flaw is in pharparsezipfile of ext/phar/zip.c. When...

Amazon Linux AMI : cloud-init (ALAS-2021-1486)

The version of cloud-init installed on the remote host is prior to 0.7.6-43.23. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1486 advisory. A flaw was found in cloud-init, where it uses the random.choice function when creating sensitive random strings used...

Amazon Linux AMI : kernel (ALAS-2021-1487)

The version of kernel installed on the remote host is prior to 4.14.225-121.357. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1487 advisory. An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV...

Amazon Linux AMI : xterm (ALAS-2021-1489)

The version of xterm installed on the remote host is prior to 295-3.15. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1489 advisory. A flaw was found in xterm. A specially crafted sequence of combining characters causes an out of bounds write leading to arbitrary co...

Amazon Linux AMI : qemu-kvm (ALAS-2021-1488)

The version of qemu-kvm installed on the remote host is prior to 1.5.3-156.26. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1488 advisory. An out-of-bound write access flaw was found in the way QEMU loads ROM contents at boot time. This flaw occurs in the...

Amazon Linux AMI : python27, python36, python38 (ALAS-2021-1484)

The version of python27 installed on the remote host is prior to 2.7.18-2.141. The version of python36 installed on the remote host is prior to 3.6.12-1.20. The version of python38 installed on the remote host is prior to 3.8.5-1.5. It is, therefore, affected by a vulnerability as referenced in t...

Amazon Linux AMI : openssl (ALAS-2021-1482)

The version of openssl installed on the remote host is prior to 1.0.2k-16.153. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1482 advisory. Calls to EVPCipherUpdate, EVPEncryptUpdate and EVPDecryptUpdate may overflow the output length argument in some cases...

Amazon Linux AMI : ImageMagick (ALAS-2021-1479)

The version of ImageMagick installed on the remote host is prior to 6.9.10.68-3.23. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1479 advisory. A flaw was found in ImageMagick. The -authenticate option is mishandled allowing user-controlled password set for a PDF...

Amazon Linux AMI : kernel (ALAS-2021-1480)

The version of kernel installed on the remote host is prior to 4.14.219-119.340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1480 advisory. 2024-05-23: CVE-2023-1390 was added to this advisory. A use-after-free flaw was found in kernel/trace/ringbuffer.c ...

CVE-2020-5812

Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack...

Code injection

Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack...

CVE-2020-5812

CVE-2020-5812 affects Nessus AMI versions 8.12.0 and earlier. The issue is with certificate validation (noted as not validating or incorrectly validating a certificate), which could allow an attacker to perform a man-in-the-middle (MITM) attack by spoofing a trusted entity. The connected document...

CVE-2020-5812

Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack...

[R1] Nessus AMI 8.13.1 Fixes One Vulnerability

Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack...