Amazon Linux 2023 : python3-cryptography (ALAS2023-2023-446)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-446 advisory. cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling loadpempkcs7certificates or loadderpkcs7certificates could lead to a NULL-pointer...

Amazon Linux 2023 : perl, perl-Attribute-Handlers, perl-AutoLoader (ALAS2023-2023-448)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-448 advisory. 2024-02-01: CVE-2023-47100 was added to this advisory. A crafted regular expression when compiled by perl 5.30.0 through 5.38.0 can cause a one-byte attacker controlled buffer overflow in a hea...

Medium: avahi

Issue Overview: A reachable assertion was found in avahirdataparse. CVE-2023-38472 Affected Packages: avahi Issue Correction: Run dnf update avahi --releasever 2023.3.20231211 or dnf update --advisory ALAS2023-2023-456 --releasever 2023.3.20231211 to update your system. More information on how to...

Medium: python-pip

Issue Overview: When installing a package from a Mercurial VCS URL ie "pip install hg+..." with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call ie "--config". Controlling the Mercurial configuration can modify how...

Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2023-453)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-453 advisory. An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of...

Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2023-433)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-433 advisory. Out-of-bounds Read vulnerability in modmacro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. CVE-2023-31122 A flaw was found in httpd. This flaw allows an attacker...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-436)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-436 advisory. 2024-03-27: CVE-2023-23908 was added to this advisory. An issue was found in redundant REX instruction prefix values affecting third generation Intel Xeon Scalable Icelake processors. The issue...

Amazon Linux 2023 : python3-twisted, python3-twisted+tls (ALAS2023-2023-432)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-432 advisory. Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously...

Amazon Linux 2023 : ecs-init (ALAS2023-2023-435)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-435 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-430)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-430 advisory. An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the VC handler and instruction emulati...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-431)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-431 advisory. Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function gagrowinner in in the file src/alloc.c at line 748, which is freed in the file...

Amazon Linux 2023 : amazon-efs-utils (ALAS2023-2023-437)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-437 advisory. efs-utils is a set of Utilities for Amazon Elastic File System EFS. A potential race condition issue exists within the Amazon EFS mount helper in efs-utils versions v1.34.3 and below. When using TLS to...

Medium: python-twisted

Issue Overview: Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by...

Medium: amazon-efs-utils

Issue Overview: efs-utils is a set of Utilities for Amazon Elastic File System EFS. A potential race condition issue exists within the Amazon EFS mount helper in efs-utils versions v1.34.3 and below. When using TLS to mount file systems, the mount helper allocates a local port for stunnel to...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2023-415)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-415 advisory. Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1...

Amazon Linux 2023 : open-vm-tools, open-vm-tools-desktop, open-vm-tools-devel (ALAS2023-2023-423)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-423 advisory. VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-...

Amazon Linux 2023 : libxml2, libxml2-devel, libxml2-static (ALAS2023-2023-411)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-411 advisory. libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is I don't think these issues...

Amazon Linux 2023 : vorbis-tools (ALAS2023-2023-414)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-414 advisory. Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files. CVE-2023-43361...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2023-404)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-404 advisory. A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2023-420)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-420 advisory. An issue was found in libcurl which allows cookies to be inserted into a running program if specific conditions are met. The libcurl provided function, curleasyduphandle, is used to duplicate t...