The version of httpd24 installed on the remote host is prior to 2.4.51-1.94. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1543 advisory.

  - A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead     to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.
    (CVE-2021-33193)

  - Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP     Server 2.4.48 and earlier. (CVE-2021-34798)

  - A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and     crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive). (CVE-2021-36160)

  - ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules     pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache     HTTP Server 2.4.48 and earlier. (CVE-2021-39275)

  - A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the     remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. (CVE-2021-40438)

  - While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request     processing, allowing an external source to DoS the server. This requires a specially crafted request. The     vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.
    (CVE-2021-41524)

  - A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could     use a path traversal attack to map URLs to files outside the directories configured by Alias-like     directives. If files outside of these directories are not protected by the usual default configuration     require all denied, these requests can succeed. If CGI scripts are also enabled for these aliased     pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This     issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found     to be incomplete, see CVE-2021-42013. (CVE-2021-41773)

  - It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker     could use a path traversal attack to map URLs to files outside the directories configured by Alias-like     directives. If files outside of these directories are not protected by the usual default configuration     require all denied, these requests can succeed. If CGI scripts are also enabled for these aliased     pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache     2.4.50 and not earlier versions. (CVE-2021-42013)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of httpd installed on the remote host is prior to 2.4.51-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1716 advisory.

  - A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead     to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.
    (CVE-2021-33193)

  - Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP     Server 2.4.48 and earlier. (CVE-2021-34798)

  - A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and     crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive). (CVE-2021-36160)

  - ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules     pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache     HTTP Server 2.4.48 and earlier. (CVE-2021-39275)

  - A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the     remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. (CVE-2021-40438)

  - While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request     processing, allowing an external source to DoS the server. This requires a specially crafted request. The     vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.
    (CVE-2021-41524)

  - A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could     use a path traversal attack to map URLs to files outside the directories configured by Alias-like     directives. If files outside of these directories are not protected by the usual default configuration     require all denied, these requests can succeed. If CGI scripts are also enabled for these aliased     pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This     issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found     to be incomplete, see CVE-2021-42013. (CVE-2021-41773)

  - It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker     could use a path traversal attack to map URLs to files outside the directories configured by Alias-like     directives. If files outside of these directories are not protected by the usual default configuration     require all denied, these requests can succeed. If CGI scripts are also enabled for these aliased     pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache     2.4.50 and not earlier versions. (CVE-2021-42013)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1714 advisory.

  - ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a     buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings     which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not     a strict requirement, ASN.1 strings that are parsed using OpenSSL's own d2i functions (and other similar     parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will     additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for     applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array     by directly setting the data and length fields in the ASN1_STRING array. This can also happen by using     the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to     assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for     strings that have been directly constructed. Where an application requests an ASN.1 structure to be     printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the     application without NUL terminating the data field, then a read buffer overrun can occur. The same thing     can also occur during name constraints processing of certificates (for example if a certificate has been     directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the     certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the     X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an     application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL     functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack).
    It could also result in the disclosure of private memory contents (such as private keys, or sensitive     plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected     1.0.2-1.0.2y). (CVE-2021-3712)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of sssd installed on the remote host is prior to 1.16.5-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1715 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1711 advisory.

  - An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take()     was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32,     causing unintended length truncation. (CVE-2021-27218)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libsndfile installed on the remote host is prior to 1.0.25-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1713 advisory.

  - A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to     execute arbitrary code via a crafted WAV file. (CVE-2021-3246)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.248-189.473. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1712 advisory.

  - A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in     the Linux kernel through 5.13.13. (CVE-2021-40490)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ca-certificates installed on the remote host is prior to 2021.2.50-72. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1710 advisory.

  - Update of ca-certificates to version 2021.2.50-72.amzn2.0.1 addresses the expiring IdentTrust DST Root CA     X3, which affected some Let's Encrypt TLS certificates. The effect of the expiring certificate would be an     inability of OpenSSL to validate impacted certificates issued by Let's Encrypt. Impacted customers may     have experienced connection or certificate errors when attempting to connect to certain websites or APIs     that use Let's Encrypt certificates. (ALAS2-2021-1710)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ca-certificates installed on the remote host is prior to 2018.2.22-65.1.24. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1536 advisory.

  - Update of ca-certificates to version 2018.2.22-65.1.24.amzn1 addresses the expiring IdentTrust DST Root CA     X3, which affected some Let's Encrypt TLS certificates. The effect of the expiring certificate would be an     inability of OpenSSL to validate impacted certificates issued by Let's Encrypt. Impacted customers may     have experienced connection or certificate errors when attempting to connect to certain websites or APIs     that use Let's Encrypt certificates. (ALAS-2021-1536)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of containerd installed on the remote host is prior to 1.4.6-3.9. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1540 advisory.

  - containerd is an open source container runtime with an emphasis on simplicity, robustness and portability.
    A bug was found in containerd where container root directories and some plugins had insufficiently     restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and     execute programs. When containers included executable programs with extended permission bits (such as     setuid), unprivileged Linux users could discover and execute those programs. When the UID of an     unprivileged Linux user on the host collided with the file owner or group inside a container, the     unprivileged Linux user on the host could discover, read, and modify those files. This vulnerability has     been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are     released and may restart containers or update directory permissions to mitigate the vulnerability. Users     unable to update should limit access to the host to trusted users. Update directory permission on     container bundles directories. (CVE-2021-41103)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of openssl installed on the remote host is prior to 1.0.2k-16.154. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1541 advisory.

  - ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a     buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings     which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not     a strict requirement, ASN.1 strings that are parsed using OpenSSL's own d2i functions (and other similar     parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will     additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for     applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array     by directly setting the data and length fields in the ASN1_STRING array. This can also happen by using     the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to     assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for     strings that have been directly constructed. Where an application requests an ASN.1 structure to be     printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the     application without NUL terminating the data field, then a read buffer overrun can occur. The same thing     can also occur during name constraints processing of certificates (for example if a certificate has been     directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the     certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the     X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an     application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL     functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack).
    It could also result in the disclosure of private memory contents (such as private keys, or sensitive     plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected     1.0.2-1.0.2y). (CVE-2021-3712)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of docker installed on the remote host is prior to 20.10.7-3.71. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1537 advisory.

  - Moby is an open-source project created by Docker to enable software containerization. A bug was found in     Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container     can result in Unix file permission changes for existing files in the hosts filesystem, widening access     to others. This bug does not directly allow files to be read, modified, or executed without an additional     cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this     version as soon as possible. Running containers do not need to be restarted. (CVE-2021-41089)

  - Moby is an open-source project created by Docker to enable software containerization. A bug was found in     Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with     insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory     contents and execute programs. When containers included executable programs with extended permission bits     (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an     unprivileged Linux user on the host collided with the file owner or group inside a container, the     unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed     in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running     containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade     limit access to the host to trusted users. Limit access to host volumes to trusted containers.
    (CVE-2021-41091)

  - Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker     CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file     (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed     would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended     private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as     soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries     in the configuration file reference an installed credential helper that is executable and on the PATH.
    (CVE-2021-41092)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.248-129.473. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1539 advisory.

  - Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP     socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux     kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196.
    (CVE-2020-16119)

  - An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass     RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users     with the ability to start and control a VM to read/write random pages of memory and can result in local     privilege escalation. (CVE-2021-22543)

  - A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on     inbound SCTP packets may allow the kernel to read uninitialized memory. (CVE-2021-3655)

  - A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was     found in the way user uses trace ring buffer in a specific way. Only privileged local users (with     CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
    (CVE-2021-3679)

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

  - arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access     permissions of a shadow page, leading to a missing guest protection page fault. (CVE-2021-38198)

  - drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to     cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain     situations. (CVE-2021-38204)

  - drivers/net/ethernet/xilinx/xilinx_emaclite.c in the Linux kernel before 5.13.3 makes it easier for     attackers to defeat an ASLR protection mechanism because it prints a kernel pointer (i.e., the real IOMEM     pointer). (CVE-2021-38205)

  - A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in     the Linux kernel through 5.13.13. (CVE-2021-40490)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote host is prior to 1.15.15-1.71. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1538 advisory.

  - Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil     ReverseProxy panic upon an ErrAbortHandler abort. (CVE-2021-36221)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of sssd installed on the remote host is prior to 1.16.4-21.26. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1542 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.243-185.433. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1699 advisory.

  - An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass     RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users     with the ability to start and control a VM to read/write random pages of memory and can result in local     privilege escalation. (CVE-2021-22543)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of openldap installed on the remote host is prior to 2.4.44-23. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1707 advisory.

  - A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the     saslAuthzTo processing, resulting in denial of service. (CVE-2020-36225)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of glibc installed on the remote host is prior to 2.26-53. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1703 advisory.

  - The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in     parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in     a denial of service or disclosure of information. This occurs because atoi was used but strtoul should     have been used to ensure correct calculations. (CVE-2021-35942)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of linuxptp installed on the remote host is prior to 2.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1705 advisory.

  - A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian     architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to     cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality     and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.
    (CVE-2021-3571)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of php-pear installed on the remote host is prior to 1.10.12-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1708 advisory.

  - Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate     checking of symbolic links, a related issue to CVE-2020-28948. (CVE-2020-36193)

  - In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different     vulnerability than CVE-2020-36193. (CVE-2021-32610)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ntp installed on the remote host is prior to 4.2.8p15-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1706 advisory.

  - The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a     denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1     requests, as exploited in the wild in December 2013. (CVE-2013-5211)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of exiv2 installed on the remote host is prior to 0.27.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1701 advisory.

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29457. Reason: This candidate is a     duplicate of CVE-2021-29457. Notes: All CVE users should reference CVE-2021-29457 instead of this     candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage. (CVE-2021-31291)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of gcc10-binutils installed on the remote host is prior to 2.35-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1702 advisory.

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using     readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary     data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and     availability. (CVE-2021-20294)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.246-187.474. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1704 advisory.

  - A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when     processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested     guest (L2). Due to improper validation of the int_ctl field, this issue could allow a malicious L1 to     enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest     would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak     of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to     5.14-rc7. (CVE-2021-3653)

  - arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access     permissions of a shadow page, leading to a missing guest protection page fault. (CVE-2021-38198)

  - A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in     the Linux kernel through 5.13.13. (CVE-2021-40490)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 78.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1709 advisory.

  - If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server     responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected     data. This could have resulted in Thunderbird showing incorrect information, for example the attacker     could have tricked Thunderbird to show folders that didn't exist on the IMAP server. This vulnerability     affects Thunderbird < 78.12. (CVE-2021-29969)

  - A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially     exploitable crash. *This bug could only be triggered when accessibility was enabled.*. This vulnerability     affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90. (CVE-2021-29970)

  - Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.12,     Firefox ESR < 78.12, and Firefox < 90. (CVE-2021-29976)

  - Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption     and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91,     Firefox ESR < 78.13, and Firefox < 91. (CVE-2021-29980)

  - Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly     considered during garbage collection. This led to memory corruption and a potentially exploitable crash.
    This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
    (CVE-2021-29984)

  - A use-after-free vulnerability in media channels could have led to memory corruption and a potentially     exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13,     and Firefox < 91. (CVE-2021-29985)

  - A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable     crash. *Note: This issue only affected Linux operating systems. Other operating systems are unaffected.*     This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
    (CVE-2021-29986)

  - Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds     read or memory corruption, and a potentially exploitable crash. This vulnerability affects Thunderbird <     78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. (CVE-2021-29988)

  - Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.13, Firefox ESR < 78.13,     and Firefox < 91. (CVE-2021-29989)

  - Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-30547)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is prior to 7.76.1-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1700 advisory.

  - curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a     flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized     data from a stack based buffer to the server, resulting in potentially revealing sensitive internal     information to the server using a clear-text network protocol. (CVE-2021-22898)

  - When curl is instructed to download content using the metalink feature, thecontents is verified against a     hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same     contentfrom a set of different URLs, potentially hosted by different servers and theclient can then     download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting     the contents has been breached and the contentsof the specific file on that server is replaced with a     modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload.
    It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and     instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the     file ondisk. (CVE-2021-22922)

  - When curl is instructed to get content using the metalink feature, and a user name and password are used     to download the metalink XML file, those same credentials are then subsequently passed on to each of the     servers from which curl will download or try to download the contents from. Often contrary to the user's     expectations and intentions and without telling the user it happened. (CVE-2021-22923)

  - libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of     them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert'     into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing     wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary     depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can     setto qualify how to verify the server certificate. (CVE-2021-22924)

  - curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used     option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for     sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer     to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-     text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing     the string provided by the application. (CVE-2021-22925)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of glib2 installed on the remote host is prior to 2.36.3-5.22. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1526 advisory.

  - An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has     an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow     could potentially lead to memory corruption. (CVE-2021-27219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libwebp installed on the remote host is prior to 0.3.0-10.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1530 advisory.

  - A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function     WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-36328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of php73 installed on the remote host is prior to 7.3.29-1.30. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1532 advisory.

  - In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation     functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password     field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially     leading to other security implications - like contacting a wrong server or making a wrong access decision.
    (CVE-2021-21705)

  - In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO     driver extension, a malicious database server could cause crashes in various database functions, such as     getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed     correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.
    (CVE-2021-21704)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote host is prior to 1.15.14-1.69. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1527 advisory.

  - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from     net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
    (CVE-2021-33197)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the     math/big.Rat SetString or UnmarshalText method. (CVE-2021-33198)

  - The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an     X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS     server to cause a TLS client to panic. (CVE-2021-34558)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.302.b08-0.67. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1528 advisory.

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle     GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2021-2341)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.3 (Integrity impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). (CVE-2021-2369)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). (CVE-2021-2388)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of openvpn installed on the remote host is prior to 2.4.11-1.48. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1531 advisory.

  - OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control     channel data on servers configured with deferred authentication, which can be used to potentially trigger     further information leaks. (CVE-2020-15078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tomcat7 installed on the remote host is prior to 7.0.109-1.41. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1534 advisory.

  - A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of     a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue     affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65. (CVE-2021-30640)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of postgresql-jdbc installed on the remote host is prior to 8.4.704-4.13. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1533 advisory.

  - PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. (CVE-2020-13692)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of lasso installed on the remote host is prior to 2.5.1-8.6. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1529 advisory.

  - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. (CVE-2021-28091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tomcat8 installed on the remote host is prior to 8.5.69-1.88. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1535 advisory.

  - Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP     transfer-encoding request header in some circumstances leading to the possibility to request smuggling     when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if     the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding;
    and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
    (CVE-2021-33037)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is prior to 7.61.1-12.99. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1525 advisory.

  - libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of     them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert'     into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing     wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary     depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can     setto qualify how to verify the server certificate. (CVE-2021-22924)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.302.b08-0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1695 advisory.

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle     GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2021-2341)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.3 (Integrity impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). (CVE-2021-2369)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). (CVE-2021-2388)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.241-184.433. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1696 advisory.

  - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from     kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects     the possibility of uninitialized memory locations on the BPF stack. (CVE-2021-34556)

  - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from     kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store     operation does not necessarily occur before a store operation that has an attacker-controlled value.
    (CVE-2021-35477)

  - A vulnerability was found in the Linux kernel in versions before v5.14-rc1. Missing size validations on     inbound SCTP packets may allow the kernel to read uninitialized memory. (CVE-2021-3655)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is prior to 7.76.1-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1693 advisory.

  - Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending     data. (CVE-2020-8231)

  - A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to     a given IP address and port, and this way potentially make curl extract information about services that     are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
    (CVE-2020-8284)

  - curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue     in FTP wildcard match parsing. (CVE-2020-8285)

  - curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to     insufficient verification of the OCSP response. (CVE-2020-8286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote host is prior to 1.15.14-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1694 advisory.

  - Go before 1.15.12 and 1.16.x before 1.16.5 attempts to allocate excessive memory (issue 1 of 2).
    (CVE-2021-33196)

  - The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an     X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS     server to cause a TLS client to panic. (CVE-2021-34558)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of xstream installed on the remote host is prior to 1.3.1-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1698 advisory.

  - XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream     versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host     only by manipulating the processed input stream. No user who followed the recommendation to setup     XStream's security framework with a whitelist limited to the minimal required types is affected. The     vulnerability is patched in version 1.4.17. (CVE-2021-29505)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of linuxptp installed on the remote host is prior to 2.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1697 advisory.

  - A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a     PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially     remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity     as well as system availability. This flaw affects linuxptp versions before 3.1.1, before 2.0.1, before     1.9.3, before 1.8.1, before 1.7.1, before 1.6.1 and before 1.5.1. (CVE-2021-3570)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.238-125.422. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1524 advisory.

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of containerd installed on the remote host is prior to 1.4.6-2.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1523 advisory.

  - containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where     pulling and extracting a specially-crafted container image can result in Unix file permission changes for     existing files in the hosts filesystem. Changes to file permissions can deny access to the expected owner     of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does     not directly allow files to be read, modified, or executed without an additional cooperating process. This     bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from     trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially     affected by this bug through policies and profiles that prevent containerd from interacting with specific     files. (CVE-2021-32760)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.238-182.422. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1691 advisory.

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.12+7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1692 advisory.

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle     GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2021-2341)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.3 (Integrity impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). (CVE-2021-2369)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). (CVE-2021-2388)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of grub2 installed on the remote host is prior to 2.06-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1684 advisory.

  - A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI     command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a     Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable     content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure     Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability     is to data confidentiality and integrity, as well as system availability. (CVE-2020-14372)

  - A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a     module used as a dependency without checking if any other dependent module is still loaded leading to a     use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot     protections. The highest threat from this vulnerability is to data confidentiality and integrity as well     as system availability. (CVE-2020-25632)

  - A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are     read with very little bounds checking and assumes the USB device is providing sane values. If properly     exploited, an attacker could trigger memory corruption leading to arbitrary code execution allowing a     bypass of the Secure Boot mechanism. The highest threat from this vulnerability is to data confidentiality     and integrity as well as system availability. (CVE-2020-25647)

  - A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied     command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage,     without sufficient bounds checking. If the function is called with a command line that references a     variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack     frame and control execution which could also circumvent Secure Boot protections. The highest threat from     this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-27749)

  - A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking     allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent     SecureBoot protections after proper triage about grub's memory layout. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-27779)

  - A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past     the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms     of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2021-20225)

  - A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs     a length calculation on the assumption that expressing a quoted single quote will require 3 characters,     while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each     quote in the input. The highest threat from this vulnerability is to data confidentiality and integrity as     well as system availability. (CVE-2021-20233)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of velocity installed on the remote host is prior to 1.7-10.2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1690 advisory.

  - An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary     system commands with the same privileges as the account running the Servlet container. This applies to     applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine     versions up to 2.2. (CVE-2020-13936)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of rpm installed on the remote host is prior to 4.11.3-40. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1689 advisory.

  - A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an     attacker who can convince a victim to install a seemingly verifiable package, whose signature header was     modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is     to data integrity, confidentiality, and system availability. (CVE-2021-20271)

  - A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can     convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM     database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects     RPM versions before 4.17.0-alpha. (CVE-2021-3421)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
154188	Amazon Linux AMI : httpd24 (ALAS-2021-1543)	critical
154179	Amazon Linux 2 : httpd (ALAS-2021-1716)	critical
153900	Amazon Linux 2 : openssl11 (ALAS-2021-1714)	high
153899	Amazon Linux 2 : sssd (ALAS-2021-1715)	high
153898	Amazon Linux 2 : glib2 (ALAS-2021-1711)	high
153897	Amazon Linux 2 : libsndfile (ALAS-2021-1713)	high
153896	Amazon Linux 2 : kernel (ALAS-2021-1712)	high
153883	Amazon Linux 2 : ca-certificates (ALAS-2021-1710)	high
153882	Amazon Linux AMI : ca-certificates (ALAS-2021-1536)	high
153864	Amazon Linux AMI : containerd (ALAS-2021-1540)	high
153863	Amazon Linux AMI : openssl (ALAS-2021-1541)	high
153861	Amazon Linux AMI : docker (ALAS-2021-1537)	high
153860	Amazon Linux AMI : kernel (ALAS-2021-1539)	high
153859	Amazon Linux AMI : golang (ALAS-2021-1538)	medium
153858	Amazon Linux AMI : sssd (ALAS-2021-1542)	high
153786	Amazon Linux 2 : kernel (ALAS-2021-1699)	high
153427	Amazon Linux 2 : openldap (ALAS-2021-1707)	high
153426	Amazon Linux 2 : glibc (ALAS-2021-1703)	critical
153425	Amazon Linux 2 : linuxptp (ALAS-2021-1705)	high
153424	Amazon Linux 2 : php-pear (ALAS-2021-1708)	high
153422	Amazon Linux 2 : ntp (ALAS-2021-1706)	medium
153421	Amazon Linux 2 : exiv2 (ALAS-2021-1701)	high
153420	Amazon Linux 2 : gcc10-binutils (ALAS-2021-1702)	high
153418	Amazon Linux 2 : kernel (ALAS-2021-1704)	high
153417	Amazon Linux 2 : thunderbird (ALAS-2021-1709)	high
153416	Amazon Linux 2 : curl (ALAS-2021-1700)	medium
153171	Amazon Linux AMI : glib2 (ALAS-2021-1526)	high
153170	Amazon Linux AMI : libwebp (ALAS-2021-1530)	critical
153169	Amazon Linux AMI : php73 (ALAS-2021-1532)	medium
153167	Amazon Linux AMI : golang (ALAS-2021-1527)	medium
153166	Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2021-1528)	high
153165	Amazon Linux AMI : openvpn (ALAS-2021-1531)	high
153164	Amazon Linux AMI : tomcat7 (ALAS-2021-1534)	medium
153163	Amazon Linux AMI : postgresql-jdbc (ALAS-2021-1533)	high
153162	Amazon Linux AMI : lasso (ALAS-2021-1529)	high
153161	Amazon Linux AMI : tomcat8 (ALAS-2021-1535)	medium
153160	Amazon Linux AMI : curl (ALAS-2021-1525)	low
153152	Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2021-1695)	high
152238	Amazon Linux 2 : kernel (ALAS-2021-1696)	low
152237	Amazon Linux 2 : curl (ALAS-2021-1693)	high
152236	Amazon Linux 2 : golang (ALAS-2021-1694)	high
152234	Amazon Linux 2 : xstream (ALAS-2021-1698)	high
152233	Amazon Linux 2 : linuxptp (ALAS-2021-1697)	high
151934	Amazon Linux AMI : kernel (ALAS-2021-1524)	high
151933	Amazon Linux AMI : containerd (ALAS-2021-1523)	medium
151931	Amazon Linux 2 : kernel (ALAS-2021-1691)	high
151930	Amazon Linux 2 : java-11-amazon-corretto (ALAS-2021-1692)	high
151799	Amazon Linux 2 : grub2 (ALAS-2021-1684)	high
151798	Amazon Linux 2 : velocity (ALAS-2021-1690)	high
151796	Amazon Linux 2 : rpm (ALAS-2021-1689)	high

Amazon Linux Local Security Checks Family for Nessus

critical

critical

high

high

high

high

high

high

high

high

high

high

high

medium

high

high

high

critical

high

high

medium

high

high

high

high

medium

high

critical

medium

medium

high

high

medium

high

high

medium

low

high

low

high

high

high

high

high

medium

high

high

high

high

high