The version of kernel installed on the remote host is prior to 4.14.238-125.422. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1524 advisory.

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of containerd installed on the remote host is prior to 1.4.6-2.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1523 advisory.

  - containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where     pulling and extracting a specially-crafted container image can result in Unix file permission changes for     existing files in the hosts filesystem. Changes to file permissions can deny access to the expected owner     of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does     not directly allow files to be read, modified, or executed without an additional cooperating process. This     bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from     trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially     affected by this bug through policies and profiles that prevent containerd from interacting with specific     files. (CVE-2021-32760)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.238-182.422. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1691 advisory.

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.12+7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1692 advisory.

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle     GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2021-2341)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.3 (Integrity impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). (CVE-2021-2369)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). (CVE-2021-2388)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of grub2 installed on the remote host is prior to 2.06-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1684 advisory.

  - A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI     command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a     Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable     content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure     Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability     is to data confidentiality and integrity, as well as system availability. (CVE-2020-14372)

  - A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a     module used as a dependency without checking if any other dependent module is still loaded leading to a     use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot     protections. The highest threat from this vulnerability is to data confidentiality and integrity as well     as system availability. (CVE-2020-25632)

  - A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are     read with very little bounds checking and assumes the USB device is providing sane values. If properly     exploited, an attacker could trigger memory corruption leading to arbitrary code execution allowing a     bypass of the Secure Boot mechanism. The highest threat from this vulnerability is to data confidentiality     and integrity as well as system availability. (CVE-2020-25647)

  - A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied     command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage,     without sufficient bounds checking. If the function is called with a command line that references a     variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack     frame and control execution which could also circumvent Secure Boot protections. The highest threat from     this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-27749)

  - A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking     allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent     SecureBoot protections after proper triage about grub's memory layout. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-27779)

  - A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past     the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms     of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2021-20225)

  - A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs     a length calculation on the assumption that expressing a quoted single quote will require 3 characters,     while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each     quote in the input. The highest threat from this vulnerability is to data confidentiality and integrity as     well as system availability. (CVE-2021-20233)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of velocity installed on the remote host is prior to 1.7-10.2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1690 advisory.

  - An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary     system commands with the same privileges as the account running the Servlet container. This applies to     applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine     versions up to 2.2. (CVE-2020-13936)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of rpm installed on the remote host is prior to 4.11.3-40. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1689 advisory.

  - A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an     attacker who can convince a victim to install a seemingly verifiable package, whose signature header was     modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is     to data integrity, confidentiality, and system availability. (CVE-2021-20271)

  - A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can     convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM     database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects     RPM versions before 4.17.0-alpha. (CVE-2021-3421)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libX11 installed on the remote host is prior to 1.6.7-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1686 advisory.

  - LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute     arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw     allowing a client to send color-name requests with a name longer than the maximum size allowed by the     protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data     exceeding the maximum size is then interpreted by the server as additional X protocol requests and     executed, e.g., to disable X server authorization completely. For example, if the victim encounters     malicious terminal control sequences for color codes, then the attacker may be able to take full control     of the running graphical session. (CVE-2021-31535)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of openssl installed on the remote host is prior to 1.0.2k-19. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1687 advisory.

  - There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit     moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime     RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed     likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have     to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low     level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected     1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t). (CVE-2019-1551)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.238-182.421. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1685 advisory.

  - Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby     man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication     procedure) by reflection of the public key and the authentication evidence of the initiating device,     potentially permitting this attacker to complete authenticated pairing with the responding device using     the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit     at a time. (CVE-2020-26558)

  - Improper access control in BlueZ may allow an authenticated user to potentially enable information     disclosure via adjacent access. (CVE-2021-0129)

  - An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to     cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h     lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf.
    (CVE-2021-29650)

  - net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI     controller. (CVE-2021-32399)

  - In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an     hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value. (CVE-2021-33034)

  - In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because     of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a     side-channel attack, aka CID-9183671af6db. (CVE-2021-33624)

  - A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. This flaw affects all the Linux kernel versions starting from 3.13. (CVE-2021-3564)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python-urllib3 installed on the remote host is prior to 1.25.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1688 advisory.

  - An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in     the authority component, the authority regular expression exhibits catastrophic backtracking, causing a     denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.
    (CVE-2021-33503)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of httpd24 installed on the remote host is prior to 2.4.48-1.92. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1514 advisory.

  - Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not     necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for     subsequent requests on the same connection to pass through with no HTTP validation, authentication or     authorization possibly configured. (CVE-2019-17567)

  - Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows     (CVE-2020-13938)

  - Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer     dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers,     leading to a Denial of Service (CVE-2020-13950)

  - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in     mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team     could create one, though some particular compiler and/or compilation option might make it possible, with     limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow     (CVE-2020-35452)

  - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can     cause a NULL pointer dereference and crash, leading to a possible Denial Of Service (CVE-2021-26690)

  - In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server     could cause a heap overflow (CVE-2021-26691)

  - Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'     (CVE-2021-30641)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.238-125.421. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1516 advisory.

  - An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to     cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h     lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf.
    (CVE-2021-29650)

  - kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic     operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel     memory, leading to local privilege escalation to root. In particular, there is a corner case where the off     reg causes a masking direction change, which then results in an incorrect final aux->alu_limit.
    (CVE-2021-33200)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nspr installed on the remote host is prior to 4.25.0-2.45. The version of nss-softokn installed on the remote host is prior to 3.53.1-6.46. The version of nss-util installed on the remote host is prior to 3.53.1-1.58. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1522 advisory.

  - When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger     an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information     disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
    (CVE-2019-11719)

  - A vulnerability exists where it possible to force Network Security Services (NSS) to sign     CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in     CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This     vulnerability affects Firefox < 68. (CVE-2019-11727)

  - Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited     to a denial of service). This vulnerability affects Firefox < 71. (CVE-2019-11756)

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting     in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming     Application Data records will be ignored. This vulnerability affects Firefox < 72. (CVE-2019-17023)

  - When converting coordinates from projective to affine, the modular inversion was not performed in constant     time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80     and Firefox for Android < 80. (CVE-2020-12400)

  - During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar     multiplication was removed, resulting in variable-time execution dependent on secret data. This     vulnerability affects Firefox < 80 and Firefox for Android < 80. (CVE-2020-12401)

  - During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean     Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform     electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes.
    *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected,     but products built on top of it might. This vulnerability affects Firefox < 78. (CVE-2020-12402)

  - A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using     multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling     multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest     threat from this vulnerability is to confidentiality and system availability. (CVE-2020-12403)

  - When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which     leaked partial information about the nonce used during signature generation. Given an electro-magnetic     trace of a few signature generations, the private key could have been computed. This vulnerability affects     Firefox < 80 and Firefox for Android < 80. (CVE-2020-6829)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of graphviz installed on the remote host is prior to 2.38.0-18.52. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1513 advisory.

  - Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote     attackers to execute arbitrary code or cause a denial of service (application crash) by loading a crafted     file into the lib/common/shapes.c component. (CVE-2020-18032)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of glibc installed on the remote host is prior to 2.17-322.181. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1511 advisory.

  - On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the     LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition,     allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass     ASLR for a setuid program. (CVE-2019-19126)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range     reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when     passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to     sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. (CVE-2020-10029)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-     based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with     a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the mention of Fixed for glibc 2.33 in the 26649 reference.
    (CVE-2020-29573)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote host is prior to 1.15.12-1.67. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1512 advisory.

  - net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of     service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each     be affected in some configurations. (CVE-2021-31525)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.292.b10-1.63. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1515 advisory.

  - Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java     SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16;
    Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N). (CVE-2021-2163)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of bind installed on the remote host is prior to 9.8.2-0.68.rc1.87. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1508 advisory.

  - In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 ->     9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND     9.17 development branch, when a vulnerable version of named receives a query for a record triggering the     flaw described above, the named process will terminate due to a failed assertion check. The vulnerability     affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other     versions of BIND 9. (CVE-2021-25215)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of postgresql92 installed on the remote host is prior to 9.2.24-3.67. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1519 advisory.

  - A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before     9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a     suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute     arbitrary SQL as the owner of the function. (CVE-2019-10208)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses     the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-     the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat     from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-25694)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one     schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of rpm installed on the remote host is prior to 4.11.3-40.79. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1521 advisory.

  - A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an     attacker who can convince a victim to install a seemingly verifiable package, whose signature header was     modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is     to data integrity, confidentiality, and system availability. (CVE-2021-20271)

  - A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can     convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM     database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects     RPM versions before 4.17.0-alpha. (CVE-2021-3421)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libX11 installed on the remote host is prior to 1.6.0-2.2.14. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1517 advisory.

  - LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute     arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw     allowing a client to send color-name requests with a name longer than the maximum size allowed by the     protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data     exceeding the maximum size is then interpreted by the server as additional X protocol requests and     executed, e.g., to disable X server authorization completely. For example, if the victim encounters     malicious terminal control sequences for color codes, then the attacker may be able to take full control     of the running graphical session. (CVE-2021-31535)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nss installed on the remote host is prior to 3.53.1-7.85. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1518 advisory.

  - A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a     remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the     NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS     versions before 3.58. (CVE-2020-25648)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of dhcp installed on the remote host is prior to 4.1.1-53.P1.29. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1510 advisory.

  - In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases     in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no     longer supported by ISC. From inspection it is clear that the defect is also present in releases from     those series, but they have not been officially tested for the vulnerability), The outcome of encountering     the defect while reading a lease that will trigger it varies, according to: the component being affected     (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler     flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced     the error on a 64-bit system. However, on a 32-bit system it is possible to cause dhclient to crash when     reading an improper lease, which could cause network connectivity problems for an affected system due to     the absence of a running DHCP client process. In dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd     server binary was built for a 32-bit architecture AND the -fstack-protection-strong flag was specified to     the compiler, dhcpd may exit while parsing a lease file containing an objectionable lease, resulting in     lack of service to clients. Additionally, the offending lease and the lease immediately following it in     the lease database may be improperly deleted. if the dhcpd server binary was built for a 64-bit     architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will not     occur, but it is possible for the offending lease and the lease which immediately followed it to be     improperly deleted. (CVE-2021-25217)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is prior to 7.61.1-12.98. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1509 advisory.

  - curl 7.1.1 to and including 7.75.0 is vulnerable to an Exposure of Private Personal Information to an     Unauthorized Actor by leaking credentials in the HTTP Referer: header. libcurl does not strip off user     credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing     HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second     HTTP request. (CVE-2021-22876)

  - curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a     flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized     data from a stack based buffer to the server, resulting in potentially revealing sensitive internal     information to the server using a clear-text network protocol. (CVE-2021-22898)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of postgresql96 installed on the remote host is prior to 9.6.22-1.85. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1520 advisory.

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of mod_http2 installed on the remote host is prior to 1.15.19-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1678 advisory.

  - Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the     size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of     these restrictions and HTTP response is sent to the client with a status code indicating why the request     was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the     offending header was the very first one received or appeared in a a footer. This led to a NULL pointer     dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2     request is easy to craft and submit, this can be exploited to DoS the server. This issue affected     mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never     released. (CVE-2021-31618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1683 advisory.

  - ** DISPUTED ** Unbound before 1.9.5 allows an integer overflow in the regional allocator via     regional_alloc. NOTE: The vendor disputes that this is a vulnerability. Although the code may be     vulnerable, a running Unbound installation cannot be remotely or locally exploited. (CVE-2019-25032)

  - ** DISPUTED ** Unbound before 1.9.5 allows an integer overflow in sldns_str2wire_dname_buf_origin, leading     to an out-of-bounds write. NOTE: The vendor disputes that this is a vulnerability. Although the code may     be vulnerable, a running Unbound installation cannot be remotely or locally exploited. (CVE-2019-25034)

  - ** DISPUTED ** Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The     vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound     installation cannot be remotely or locally exploited. (CVE-2019-25035)

  - ** DISPUTED ** Unbound before 1.9.5 allows an assertion failure and denial of service in synth_cname.
    NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running     Unbound installation cannot be remotely or locally exploited. (CVE-2019-25036)

  - ** DISPUTED ** Unbound before 1.9.5 allows an assertion failure and denial of service in dname_pkt_copy     via an invalid packet. NOTE: The vendor disputes that this is a vulnerability. Although the code may be     vulnerable, a running Unbound installation cannot be remotely or locally exploited. (CVE-2019-25037)

  - ** DISPUTED ** Unbound before 1.9.5 allows an integer overflow in a size calculation in     dnscrypt/dnscrypt.c. NOTE: The vendor disputes that this is a vulnerability. Although the code may be     vulnerable, a running Unbound installation cannot be remotely or locally exploited. (CVE-2019-25038)

  - ** DISPUTED ** Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c.
    NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running     Unbound installation cannot be remotely or locally exploited. (CVE-2019-25039)

  - ** DISPUTED ** Unbound before 1.9.5 allows an infinite loop via a compressed name in dname_pkt_copy. NOTE:
    The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound     installation cannot be remotely or locally exploited. (CVE-2019-25040)

  - ** DISPUTED ** Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy.
    NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running     Unbound installation cannot be remotely or locally exploited. (CVE-2019-25041)

  - ** DISPUTED ** Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy.
    NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running     Unbound installation cannot be remotely or locally exploited. (CVE-2019-25042)

  - NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version     4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID     file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case     the file was already present, they would follow symlinks if the file happened to be a symlink instead of a     regular file. An additional chown of the file would then take place after it was written, making the user     Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user     Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would     like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root     privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability     that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker     having access to the limited permission user Unbound/NSD runs as and point through the symlink to a     critical file on the system. (CVE-2020-28935)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of transfig installed on the remote host is prior to 3.2.8a-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1682 advisory.

  - An Out of Bounds flaw was found fig2dev version 3.2.8a. A flawed bounds check in read_objects() could     allow an attacker to provide a crafted malicious input causing the application to either crash or in some     cases cause memory corruption. The highest threat from this vulnerability is to integrity as well as     system availability. (CVE-2021-3561)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libwebp installed on the remote host is prior to 0.3.0-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1676 advisory.

  - A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow was found in PutLE16().
    The highest threat from this vulnerability is to data confidentiality and integrity as well as system     availability. (CVE-2018-25011)

  - A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function     WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-36328)

  - A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being     killed too early. The highest threat from this vulnerability is to data confidentiality and integrity as     well as system availability. (CVE-2020-36329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of httpd installed on the remote host is prior to 2.4.48-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1674 advisory.

  - Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not     necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for     subsequent requests on the same connection to pass through with no HTTP validation, authentication or     authorization possibly configured. (CVE-2019-17567)

  - Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows     (CVE-2020-13938)

  - Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer     dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers,     leading to a Denial of Service (CVE-2020-13950)

  - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in     mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team     could create one, though some particular compiler and/or compilation option might make it possible, with     limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow     (CVE-2020-35452)

  - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can     cause a NULL pointer dereference and crash, leading to a possible Denial Of Service (CVE-2021-26690)

  - In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server     could cause a heap overflow (CVE-2021-26691)

  - Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'     (CVE-2021-30641)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.232-177.418. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1675 advisory.

  - kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic     operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel     memory, leading to local privilege escalation to root. In particular, there is a corner case where the off     reg causes a masking direction change, which then results in an incorrect final aux->alu_limit.
    (CVE-2021-33200)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of qt5-qtimageformats installed on the remote host is prior to 5.9.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1679 advisory.

  - A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow was found in PutLE16().
    The highest threat from this vulnerability is to data confidentiality and integrity as well as system     availability. (CVE-2018-25011)

  - A flaw was found in libwebp in versions before 1.0.1. An unitialized variable is used in function     ReadSymbol. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2018-25014)

  - A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function     WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-36328)

  - A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being     killed too early. The highest threat from this vulnerability is to data confidentiality and integrity as     well as system availability. (CVE-2020-36329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 78.11.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1681 advisory.

  - OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored     unencrypted on the user's local disk. The master password protection was inactive for those keys. Version     78.10.2 will restore the protection mechanism for newly imported keys, and will automatically protect keys     that had been imported using affected Thunderbird versions. This vulnerability affects Thunderbird <     78.10.2. (CVE-2021-29956)

  - If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an     additional unprotected part, Thunderbird did not indicate that only parts of the message are protected.
    This vulnerability affects Thunderbird < 78.10.2. (CVE-2021-29957)

  - Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and     Firefox ESR < 78.11. (CVE-2021-29967)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of gupnp installed on the remote host is prior to 1.0.2-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1673 advisory.

  - An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A     remote web server can exploit this vulnerability to trick a victim's browser into triggering actions     against local UPnP services implemented using this library. Depending on the affected service, this could     be used for data exfiltration, data tempering, etc. (CVE-2021-33516)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1677 advisory.

  - There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted     file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to     confidentiality, integrity, and availability. (CVE-2021-3516)

  - There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to     be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact     from this flaw is to confidentiality, integrity, and availability. (CVE-2021-3518)

  - A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while     parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery     mode and post-validated, the flaw could be used to crash the application. The highest threat from this     vulnerability is to system availability. (CVE-2021-3537)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of samba installed on the remote host is prior to 4.10.16-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1680 advisory.

  - A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix     group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end     of the array in the case where a negative cache entry had been added to the mapping cache. This could     cause the calling code to return those values into the process token that stores the group membership for     a user. The highest threat from this vulnerability is to data confidentiality and integrity.
    (CVE-2021-20254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of httpd installed on the remote host is prior to 2.4.46-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1672 advisory.

  - Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the     size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of     these restrictions and HTTP response is sent to the client with a status code indicating why the request     was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the     offending header was the very first one received or appeared in a a footer. This led to a NULL pointer     dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2     request is easy to craft and submit, this can be exploited to DoS the server. This issue affected     mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never     released. (CVE-2021-31618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of systemd installed on the remote host is prior to 219-78. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1647 advisory.

  - A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd     re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly     lead to root privilege escalation. Affected releases are systemd versions up to and including 239.
    (CVE-2018-15686)

  - An allocation of memory without limits, that could result in the stack clashing with another memory     region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A     local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through     v240 are vulnerable. (CVE-2018-16864)

  - An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate     with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221     to v239 are vulnerable. (CVE-2018-16866)

  - An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the     udevadm trigger command, a memory leak may occur. (CVE-2019-20386)

  - A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux.
    Function dispatch_message_real() in journald-server.c does not free the memory allocated by     set_iovec_field_free() to store the `_CMDLINE=` entry. A local attacker may use this flaw to make systemd-     journald crash. This issue only affects versions shipped with Red Hat Enterprise since v219-62.2.
    (CVE-2019-3815)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of httpd installed on the remote host is prior to 2.4.48-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1659 advisory.

  - Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not     necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for     subsequent requests on the same connection to pass through with no HTTP validation, authentication or     authorization possibly configured. (CVE-2019-17567)

  - Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows     (CVE-2020-13938)

  - Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer     dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers,     leading to a Denial of Service (CVE-2020-13950)

  - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in     mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team     could create one, though some particular compiler and/or compilation option might make it possible, with     limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow     (CVE-2020-35452)

  - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can     cause a NULL pointer dereference and crash, leading to a possible Denial Of Service (CVE-2021-26690)

  - In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server     could cause a heap overflow (CVE-2021-26691)

  - Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'     (CVE-2021-30641)

  - Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the     size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of     these restrictions and HTTP response is sent to the client with a status code indicating why the request     was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the     offending header was the very first one received or appeared in a a footer. This led to a NULL pointer     dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2     request is easy to craft and submit, this can be exploited to DoS the server. This issue affected     mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never     released. (CVE-2021-31618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of glibc installed on the remote host is prior to 2.26-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1656 advisory.

  - In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-     based buffer over-read via an attempted case-insensitive regular-expression match. (CVE-2019-9169)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance     the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a     different vulnerability from CVE-2016-10228. (CVE-2020-27618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of microcode_ctl installed on the remote host is prior to 2.1-47. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1663 advisory.

  - Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow     an authenticated user to potentially enable information disclosure via local access. (CVE-2020-8696)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nss installed on the remote host is prior to 3.53.1-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1664 advisory.

  - A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a     remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the     NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS     versions before 3.58. (CVE-2020-25648)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libX11 installed on the remote host is prior to 1.6.7-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1661 advisory.

  - An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was     implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid     programs call XIM client functions while running with elevated privileges. No such programs are shipped     with Red Hat Enterprise Linux. (CVE-2020-14344)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of wpa_supplicant installed on the remote host is prior to 2.6-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1648 advisory.

  - In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check.
    This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no     additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525 (CVE-2021-0326)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of slapi-nis installed on the remote host is prior to 0.56.5-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1646 advisory.

  - A flaw was found in slapi-nis in versions before 0.56.7. A NULL pointer dereference during the parsing of     the Binding DN could allow an unauthenticated attacker to crash the 389-ds-base directory server. The     highest threat from this vulnerability is to system availability. (CVE-2021-3480)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is prior to 7.61.1-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1653 advisory.

  - curl 7.1.1 to and including 7.75.0 is vulnerable to an Exposure of Private Personal Information to an     Unauthorized Actor by leaking credentials in the HTTP Referer: header. libcurl does not strip off user     credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing     HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second     HTTP request. (CVE-2021-22876)

  - curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a     flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized     data from a stack based buffer to the server, resulting in potentially revealing sensitive internal     information to the server using a clear-text network protocol. (CVE-2021-22898)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of bzip2 installed on the remote host is prior to 1.0.6-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1652 advisory.

  - BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many     selectors. (CVE-2019-12900)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of postgresql installed on the remote host is prior to 9.2.24-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1665 advisory.

  - A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before     9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a     suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute     arbitrary SQL as the owner of the function. (CVE-2019-10208)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses     the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-     the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat     from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-25694)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one     schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1651 advisory.

  - In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and     9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11     of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR     triggering the flaw described above, the named process will terminate due to a failed assertion the next     time the transferred secondary zone is refreshed. (CVE-2021-25214)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
151934	Amazon Linux AMI : kernel (ALAS-2021-1524)	high
151933	Amazon Linux AMI : containerd (ALAS-2021-1523)	critical
151931	Amazon Linux 2 : kernel (ALAS-2021-1691)	high
151930	Amazon Linux 2 : java-11-amazon-corretto (ALAS-2021-1692)	high
151799	Amazon Linux 2 : grub2 (ALAS-2021-1684)	high
151798	Amazon Linux 2 : velocity (ALAS-2021-1690)	high
151796	Amazon Linux 2 : rpm (ALAS-2021-1689)	high
151795	Amazon Linux 2 : libX11 (ALAS-2021-1686)	critical
151794	Amazon Linux 2 : openssl (ALAS-2021-1687)	medium
151793	Amazon Linux 2 : kernel (ALAS-2021-1685)	medium
151792	Amazon Linux 2 : python-urllib3 (ALAS-2021-1688)	high
151522	Amazon Linux AMI : httpd24 (ALAS-2021-1514)	critical
151521	Amazon Linux AMI : kernel (ALAS-2021-1516)	high
151520	Amazon Linux AMI : nspr, nss-softokn, nss-util (ALAS-2021-1522)	critical
151519	Amazon Linux AMI : graphviz (ALAS-2021-1513)	high
151518	Amazon Linux AMI : glibc (ALAS-2021-1511)	low
151517	Amazon Linux AMI : golang (ALAS-2021-1512)	medium
151515	Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2021-1515)	medium
151514	Amazon Linux AMI : bind (ALAS-2021-1508)	high
151513	Amazon Linux AMI : postgresql92 (ALAS-2021-1519)	high
151512	Amazon Linux AMI : rpm (ALAS-2021-1521)	high
151511	Amazon Linux AMI : libX11 (ALAS-2021-1517)	critical
151510	Amazon Linux AMI : nss (ALAS-2021-1518)	high
151509	Amazon Linux AMI : dhcp (ALAS-2021-1510)	high
151508	Amazon Linux AMI : curl (ALAS-2021-1509)	medium
151507	Amazon Linux AMI : postgresql96 (ALAS-2021-1520)	high
151277	Amazon Linux 2 : mod_http2 (ALAS-2021-1678)	high
151275	Amazon Linux 2 : unbound (ALAS-2021-1683)	critical
151274	Amazon Linux 2 : transfig (ALAS-2021-1682)	high
151273	Amazon Linux 2 : libwebp (ALAS-2021-1676)	critical
151272	Amazon Linux 2 : httpd (ALAS-2021-1674)	critical
151271	Amazon Linux 2 : kernel (ALAS-2021-1675)	high
151270	Amazon Linux 2 : qt5-qtimageformats (ALAS-2021-1679)	critical
151269	Amazon Linux 2 : thunderbird (ALAS-2021-1681)	high
151268	Amazon Linux 2 : gupnp (ALAS-2021-1673)	high
151267	Amazon Linux 2 : libxml2 (ALAS-2021-1677)	high
151266	Amazon Linux 2 : samba (ALAS-2021-1680)	medium
150994	Amazon Linux 2 : httpd (ALAS-2021-1672)	high
150993	Amazon Linux 2 : systemd (ALAS-2021-1647)	critical
150983	Amazon Linux 2 : httpd (ALAS-2021-1659)	critical
150980	Amazon Linux 2 : glibc (ALAS-2021-1656)	critical
150979	Amazon Linux 2 : microcode_ctl (ALAS-2021-1663)	medium
150978	Amazon Linux 2 : nss (ALAS-2021-1664)	high
150977	Amazon Linux 2 : libX11 (ALAS-2021-1661)	medium
150976	Amazon Linux 2 : wpa_supplicant (ALAS-2021-1648)	high
150975	Amazon Linux 2 : slapi-nis (ALAS-2021-1646)	high
150974	Amazon Linux 2 : curl (ALAS-2021-1653)	medium
150973	Amazon Linux 2 : bzip2 (ALAS-2021-1652)	critical
150972	Amazon Linux 2 : postgresql (ALAS-2021-1665)	high
150971	Amazon Linux 2 : bind (ALAS-2021-1651)	medium

Amazon Linux Local Security Checks Family for Nessus

high

critical

high

high

high

high

high

critical

medium

medium

high

critical

high

critical

high

low

medium

medium

high

high

high

critical

high

high

medium

high

high

critical

high

critical

critical

high

critical

high

high

high

medium

high

critical

critical

critical

medium

high

medium

high

high

medium

critical

high

medium