Medium: amazon-cloudwatch-agent

Issue Overview: go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data CVE-2025-11065 Affected Packages: amazon-cloudwatch-agent Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Co...

Medium: amazon-cloudwatch-agent

Issue Overview: go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data CVE-2025-11065 Affected Packages: amazon-cloudwatch-agent Issue Correction: Run dnf update amazon-cloudwatch-agent --releasever 2023.9.20251014 or dnf update --advisory ALAS2023-2025-1224...

EUVD-2022-7662

Malicious code in bioql PyPI...

Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2025-2904)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300055.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2904 advisory. The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus...

Medium: amazon-cloudwatch-agent

Issue Overview: The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result i...

Medium: amazon-cloudwatch-agent

Issue Overview: The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result i...

Medium: amazon-cloudwatch-agent

Issue Overview: The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result i...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2025-1029)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1029 advisory. The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags...

Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2025-2851)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300054.1-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2851 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size...

Important: amazon-cloudwatch-agent

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Important: amazon-cloudwatch-agent

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: ytt, aws-flb-cloudwatch, pdfcpu, nri-cassandra, kubernetes-csi-external-attacher, step, aws-flb-kinesis, fluent-operator, docker-credential-ecr-login, licenseclassifier, render-template, ingress-nginx-controller, crossplane-provider-family-azure, sealed-secrets,...

GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: ytt, aws-flb-cloudwatch, pdfcpu, nri-cassandra, kubernetes-csi-external-attacher, step, aws-flb-kinesis, fluent-operator, docker-credential-ecr-login, licenseclassifier, render-template, ingress-nginx-controller, crossplane-provider-family-azure, sealed-secrets,...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: yace-fips, prometheus-redis-exporter-fips, promxy, kubewatch, containerd-fips, dagdotdev, kubernetes-csi-external-resizer-fips, kubernetes-dashboard-metrics-scraper, kyverno-policy-reporter-kyverno-plugin-fips, nvidia-nsight-compute-13.2, docker-cli-fips, extism,...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: zarf, grafana-agent-operator, terragrunt, vexctl, amazon-cloudwatch-agent-operator, sftpgo-plugin-pubsub, buildkitd, terraform-provider-azurerm, step, sops, crossplane-provider-azure-sql, flux-notification-controller, glab, terraform-provider-azapi, promxy,...

GHSA-MH63-6H87-95CP vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-fips, flux-kustomize-controller-fips, promxy, tekton-chains, flux-image-automation-controller-fips, sftpgo-plugin-kms, azcopy-fips, aws-eks-pod-identity-agent, aws-eks-pod-identity-agent-fips, chezmoi, flux-source-controller-fips, cosign,...

Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2025-2779)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300052.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2779 advisory. Calling any of the Parse functions on Go source code which contains deeply nested literals can cause ...

Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2024-2630)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300044.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2630 advisory. Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability...

Important: amazon-cloudwatch-agent

Issue Overview: Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-35255 The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows...

Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2024-2550)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300039.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2550 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an...