2,033 results · Clear filters · Feed
-
MediumALAS2-2021-1670 2 CVEs
Moderate: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-27619: In Python3's Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. 1889886: CVE-2020-27619 python: Unsafe use of e…
first Jun 16, 2021 -
MediumALAS2-2021-1669 1 CVE
Moderate: python security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-26116: A flaw was found in Python. The built-in modules httplib and http.client (included in Python 2 and Python 3, respectively) do not properly validate CRLF s…
first Jun 16, 2021 -
Medium max 6.5ALAS2-2021-1668 1 CVE
Moderate: python-urllib3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-26137: A flaw was found in python-urllib3. The HTTPConnection.request() does not properly validate CRLF sequences in the HTTP request method, potentially allowin…
first Jun 16, 2021 -
Medium max 6.1ALAS2-2021-1666 1 CVE
Moderate: python-lxml security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-27783: A Cross-site Scripting (XSS) vulnerability was found in the python-lxml's clean module. The module's parser did not properly imitate browsers, causing dif…
first Jun 16, 2021 -
MediumALAS2-2021-1664 1 CVE
Moderate: nss security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-25648: A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, caus…
first Jun 16, 2021 -
MediumALAS2-2021-1663 1 CVE
Moderate: microcode_ctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-8696: A flaw was found in the Intel Advanced Vector Extensions (AVX) implementation, where a local authenticated attacker with the ability to execute AVX instruc…
first Jun 16, 2021 -
Medium max 8.6ALAS2-2021-1662 3 CVEs
Moderate: libxml2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3541: No description is available for this CVE. 1950515: CVE-2021-3541 libxml2: Exponential entity expansion attack bypasses all existing protection mechanisms C…
first Jun 16, 2021 -
Medium max 6.7ALAS2-2021-1661 1 CVE
Moderate: libX11 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14344: A flaw was found in libX11. An integer overflow leading to a heap-buffer overflow occurs when setuid programs call XIM client functions while running with…
first Jun 16, 2021 -
MediumALAS2-2021-1658 1 CVE
Moderate: hivex security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3504: A flaw was found in the hivex library. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially craft…
first Jun 16, 2021 -
Medium max 5.9ALAS2-2021-1657 1 CVE
Moderate: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-31525: A vulnerability was found in net/http of the Go standard library when parsing very large HTTP header values, causing a crash and subsequent denial of serv…
first Jun 16, 2021 -
Medium max 5.5ALAS2-2021-1656 2 CVEs
Moderate: glibc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-27618: A flaw was found in glibc. If an attacker provides the iconv function with invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, IBM13…
first Jun 16, 2021 -
Medium max 5.3ALAS2-2021-1653 2 CVEs
Moderate: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-22898: A vulnerability was found in curl where a flaw in the option parser for sending NEW_ENV variables libcurl can pass uninitialized data from a stack-based b…
first Jun 16, 2021 -
Medium max 6.5ALAS2-2021-1651 1 CVE
Moderate: bind security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-25214: Incremental zone transfers (IXFR) provide a way of transferring changed portion(s) of a zone between servers. An IXFR stream containing SOA records with a…
first Jun 16, 2021 -
MediumALAS2-2021-1650 1 CVE
Moderate: 389-ds-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-35518: When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthe…
first Jun 16, 2021 -
MediumALAS2-2021-1648 1 CVE
Moderate: wpa_supplicant security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-0326: In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if the ta…
first Jun 16, 2021 -
MediumALAS2-2021-1642 1 CVE
Moderate: spamassassin security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-1946: A flaw was found in spamassassin. Malicious rule configuration (.cf) files can be configured to run system commands without any output or errors allowing e…
first May 20, 2021 -
Medium max 5.9ALAS2-2021-1640 2 CVEs
Moderate: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3426: No description is available for this CVE. 1935913: CVE-2021-3426 python: information disclosure via pydoc CVE-2021-23336: The package python/cpython is vul…
first May 20, 2021 -
Medium max 7.5ALAS2-2021-1639 1 CVE
Moderate: python-pip security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-20916: The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have…
first May 20, 2021 -
MediumALAS2-2021-1638 1 CVE
Moderate: openldap security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-25692: A NULL pointer dereference flaw was found in the OpenLDAP server, during a request for renaming RDNs. This flaw allows a remote, unauthenticated attacker …
first May 20, 2021 -
Medium max 6.9
Moderate: ipa security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-11023: A flaw was found in jQuery. HTML containing <option> elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulatio…
first Apr 20, 2021 -
Medium max 8.0ALAS2-2021-1621 1 CVE
Moderate: git security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-21300: Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well…
-
Medium max 5.5ALAS2-2021-1620 1 CVE
Moderate: cloud-init security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3429: A vulnerability was discovered in cloud-init which can improperly disclose randomly generated passwords as part of the chpasswd module. The fix prevents th…
first Mar 18, 2021 -
MediumALAS2-2021-1617 2 CVEs
Moderate: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-16092: An assertion failure flaw was found in QEMU in the network packet processing component. This issue affects the "e1000e" and "vmxnet3" network devices. Thi…
first Mar 18, 2021 -
Medium max 7.5ALAS2-2021-1615 1 CVE
Moderate: glibc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3326: A flaw was found in glibc's iconv() functionality. This flaw allows an attacker capable of supplying a crafted sequence of characters to an application usi…
first Mar 18, 2021 -
Medium max 9.8ALAS2-2021-1611 1 CVE
Moderate: python security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3177: A flaw was found in python. A stack-based buffer overflow was discovered in the ctypes module provided within Python. Applications that use ctypes without …
-
MediumALAS2-2021-1595 1 CVE
Moderate: cloud-init security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-0816: A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka 'Azure SSH…
first Feb 8, 2021 -
MediumALAS2-2021-1601 3 CVEs
Moderate: p11-kit security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-29363: An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/rem…
first Feb 17, 2021 -
MediumALAS2-2021-1610 3 CVEs
Moderate: perl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-12723: regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. 1838000: CVE-2020-1272…
-
MediumALAS2-2021-1609 2 CVEs
Moderate: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3115: Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch…
-
Medium max 7.5ALAS2-2021-1608 3 CVEs
Moderate: openssl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-23841: The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained …
-
Medium max 7.8ALAS2-2021-1589 1 CVE
Moderate: python-rtslib security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14019: A flaw was found in Open-iSCSI rtslib-fb through versions 2.1.72, where it has weak permissions for /etc/target/saveconfig.json because the shutil.copyfil…
first Jan 25, 2021 -
MediumALAS2-2021-1591 1 CVE
Moderate: targetcli security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-13867: An access flaw was found in targetcli, where the `/etc/target` and underneath backup directory/files were world-readable. This flaw allows a local attacke…
first Jan 25, 2021 -
MediumALAS2-2021-1587 3 CVEs
Moderate: dnsmasq security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-25686: A flaw was found in dnsmasq. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. …
first Jan 25, 2021 -
MediumALAS2-2021-1577 1 CVE
Moderate: gd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2016-5766: An integer overflow, leading to a heap-based buffer overflow was found in the imagecreatefromgd2() function of PHP's gd extension. A remote attacker c…
first Jan 5, 2021 -
MediumALAS2-2021-1575 1 CVE
Moderate: chrony security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14367: A flaw was found in chrony when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup while still running as …
first Jan 5, 2021 -
Medium max 7.8
Moderate: php-pear security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-28949: Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwr…
first Jan 5, 2021 -
MediumALAS2-2021-1583 1 CVE
Moderate: pacemaker security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-25654: An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with va…
first Jan 5, 2021 -
Medium max 5.3ALAS2-2021-1579 7 CVEs
Moderate: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14803: Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exp…
first Jan 5, 2021 -
MediumALAS2-2021-1578 3 CVEs
Moderate: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-28367: Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. 1897646: CVE-2020-28367 golang: improper validation of cgo flags can lead to code ex…
first Jan 5, 2021 -
Medium max 4.6ALAS2-2021-1576 3 CVEs
Moderate: cloud-init security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-8632: A flaw was found in cloud-init, where it uses short passwords when generating a random password in new instances. Depending on the instance configuration, …
first Jan 5, 2021