CVE-2020-11487

CVE-2020-11487 affects NVIDIA DGX-1, DGX-2, and DGX A100 servers via AMI BMC firmware with a hard-coded RSA 1024 key and weak ciphers, leading to information disclosure over the BMC. Affected firmware is before 3.38.30 (DGX-1), before 1.06.06 (DGX-2), and before 00.13.16 (DGX A100). NVIDIA provid...

CVE-2020-11484

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a vulnerability in the AMI BMC firmware in which an attacker with administrative privileges can obtain the hash of the BMC/IPMI user password, which may lead to information disclosure...

CVE-2020-11483

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which the firmware includes hard-coded credentials, which may lead to elevation of privileges or information...

CVE-2020-11484

CVE-2020-11484 affects NVIDIA DGX-1 (and DGX-2, DGX A100) with AMI BMC firmware older than 3.38.30. The vulnerability allows an attacker with administrative privileges to obtain the hash of the BMC/IPMI user password, potentially leading to information disclosure. NVIDIA’s security bulletin docum...

Security Bulletin: AMI Baseboard Management Controller (BMC) Firmware Vulnerabilities in NVIDIA DGX-1, DGX-2, and DGX A100 Servers - October 2020

NVIDIA has released a firmware security update for NVIDIA DGX™ servers. This update addresses security issues in the AMI Baseboard Management Controller BMC firmware that may lead to remote code execution, elevation of privileges, or information disclosure. All issues require network access to th...

Amazon Linux AMI : golang (ALAS-2020-1436)

The version of golang installed on the remote host is prior to 1.13.15-1.59. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1436 advisory. The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder...

Amazon Linux AMI : kernel (ALAS-2020-1437)

The version of kernel installed on the remote host is prior to 4.14.200-116.320. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1437 advisory. In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and...

Amazon Linux 2 : bash (ALAS-2020-1503)

The version of bash installed on the remote host is prior to 4.2.46-34. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1503 advisory. rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASHCMDS, thus allowing the user to execute any command...

Amazon Linux AMI : postgresql96 (ALAS-2020-1443)

The version of postgresql96 installed on the remote host is prior to 9.6.19-1.83. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1443 advisory. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common...

Amazon Linux AMI : mysql57 (ALAS-2020-1439)

The version of mysql57 installed on the remote host is prior to 5.7.31-1.16. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1439 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are...

Amazon Linux AMI : postgresql94 (ALAS-2020-1441)

The version of postgresql94 installed on the remote host is prior to 9.4.26-1.77. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1441 advisory. A flaw was discovered in postgresql where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER...

Amazon Linux AMI : php72, php73 (ALAS-2020-1440)

The version of php72 installed on the remote host is prior to 7.2.34-1.26. The version of php73 installed on the remote host is prior to 7.3.23-1.29. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1440 advisory. In PHP versions 7.2.x below 7.2.34, 7.3.x belo...

Amazon Linux AMI : libxml2 (ALAS-2020-1438)

The version of libxml2 installed on the remote host is prior to 2.9.1-6.4.41. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1438 advisory. xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc-oldNs...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2020-1434)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.265.b01-0.54. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1434 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries...

Amazon Linux AMI : clamav (ALAS-2020-1433)

The version of clamav installed on the remote host is prior to 0.102.4-1.44. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1433 advisory. Fixed a vulnerability in the ARJ archive-parsing module in ClamAV 0.102.3 that could cause a denial-of- service DoS...

Amazon Linux AMI : python34, python36, python35 (ALAS-2020-1432)

The version of python34 installed on the remote host is prior to 3.4.10-1.52. The version of python35 installed on the remote host is prior to 3.5.9-1.28. The version of python36 installed on the remote host is prior to 3.6.12-1.19. It is, therefore, affected by multiple vulnerabilities as...

Amazon Linux AMI : kernel (ALAS-2020-1430)

The version of kernel installed on the remote host is prior to 4.14.193-113.317. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1430 advisory. 2024-05-23: CVE-2020-14356 was added to this advisory. A flaw null pointer dereference in the Linux kernel cgroupv2...

Amazon Linux AMI : chrony (ALAS-2020-1431)

The version of chrony installed on the remote host is prior to 3.2-1.27. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1431 advisory. A flaw was found in chrony when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup...

Amazon Linux AMI : samba (ALAS-2020-1424)

The version of samba installed on the remote host is prior to 4.10.4-11.51. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1424 advisory. A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when...

Amazon Linux AMI : python34, python35 (ALAS-2020-1429)

The version of python34 installed on the remote host is prior to 3.4.10-1.51. The version of python35 installed on the remote host is prior to 3.5.9-1.27. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1429 advisory. In Lib/tarfile.py in Python through 3.8.3...