Amazon Linux 2023 : orc, orc-compiler, orc-devel (ALAS2023-2024-728)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-728 advisory. Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2024-719)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-719 advisory. NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-724)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-724 advisory. In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix AUX buffer serialization CVE-2024-46713 In the Linux kernel, the following vulnerability has been resolved:...

Amazon Linux 2023 : python3.11-pip, python3.11-pip-wheel (ALAS2023-2024-729)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-729 advisory. urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However...

Amazon Linux 2023 : runc (ALAS2023-2024-725)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-725 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or...

Medium: aws-cfn-bootstrap

Issue Overview: Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to th...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2024-733)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-733 advisory. Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion. CVE-2024-34155 Calling Decoder.Decode on a message which...

Amazon Linux 2023 : cups-filters, cups-filters-devel, cups-filters-libs (ALAS2023-2024-723)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-723 advisory. 2024-11-13: CVE-2024-47850 was added to this advisory. CUPS is a standards-based, open-source printing system, and libcupsfilters contains the code of the filters of the former cups-filters...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2024-720)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-720 advisory. libtiff: NULL pointer dereference in tifdirinfo.c CVE-2024-7006 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested...

Amazon Linux 2023 : gdb, gdb-gdbserver, gdb-headless (ALAS2023-2024-738)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-738 advisory. GNU gdb GDB 13.0.50.20220805-git was discovered to contain a stack overflow via the function adadecode at /gdb/ada-lang.c. CVE-2023-39128 GNU gdb GDB 13.0.50.20220805-git was discovered to...

Amazon Linux 2023 : liboath, liboath-devel, libpskc (ALAS2023-2024-722)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-722 advisory. oath-toolkit: Local root exploit in a PAM module CVE-2024-47191 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested...

Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2024-730)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-730 advisory. urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2024-721)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-721 advisory. Issue summary: Applications performing certificate name checks e.g., TLSclients checking server certificates may attempt to read an invalid memoryaddress resulting in abnormal termination of the...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2024-735)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-735 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-731)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-731 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: walk over current view on netlink dump CVE-2024-27017 In the Linux kernel, the following vulnerabili...

Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2024-734)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-734 advisory. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2024-727)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-727 advisory. Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers from the client side to trigger unnecessarily expensive...

Amazon Linux 2023 : cups-filters, cups-filters-devel, cups-filters-libs (ALAS2023-2024-718)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-718 advisory. A flaw in cups-filters allows a remote unauthenticated client to create a PPD configuration file with code injection. If a job is sent to the compromised printer, the code is executed allowing for remot...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2024-717)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-717 advisory. Denial-of-service due to unbounded pattern matching CVE-2024-31228 Lua library commands may be exploited by an authenticated user to achieve remote-code-execution CVE-2024-31449 Tenable has...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-715)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-715 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize CVE-2024-35807 Tenable has extracted the preceding description block directly from the test...