Alibaba Security Advisories · December 2024 — Alibaba Security Advisories
10 advisories 12 CVEs 1 EXPLOITED

Alibaba Cloud Linux 2 advisories and cross-source Alibaba/Aliyun CVEs for 2024-12. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 1 is already weaponised in the wild — see the Exploited section.

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

Advisories

ALINUX2-SA-2024:0049

ALINUX 2Active exploitation (sightings)2024-12-03

ALINUX2-SA-2024:0049: squid security update (Important)

CVEs:CVE-2024-45802

Affected products

ProductStatusVendorPackageEcosystem
squid affected Alibaba Cloud squid
Upstream advisory

ALINUX2-SA-2024:0046

ALINUX 2Active exploitation (sightings)2024-12-03

ALINUX2-SA-2024:0046: libsoup security update (Important)

CVEs:CVE-2024-52530

Affected products

ProductStatusVendorPackageEcosystem
libsoup affected Alibaba Cloud libsoup
Upstream advisory

ALINUX2-SA-2024:0041

ALINUX 2PoC exploit2024-12-02

ALINUX2-SA-2024:0041: python-setuptools security update (Important)

CVEs:CVE-2024-6345

Affected products

ProductStatusVendorPackageEcosystem
python-setuptools affected Alibaba Cloud python-setuptools
Upstream advisory

ALINUX2-SA-2024:0043

ALINUX 2PoC exploit2024-12-02

ALINUX2-SA-2024:0043: python3-setuptools security update (Important)

CVEs:CVE-2024-6345

Affected products

ProductStatusVendorPackageEcosystem
python3-setuptools affected Alibaba Cloud python3-setuptools
Upstream advisory

ALINUX2-SA-2024:0048

ALINUX 2PoC exploit2024-12-03

ALINUX2-SA-2024:0048: postgresql security update (Important)

CVEs:CVE-2024-7348

Affected products

ProductStatusVendorPackageEcosystem
postgresql affected Alibaba Cloud postgresql
Upstream advisory

ALINUX2-SA-2024:0045

ALINUX 2Coalition ESS < 30%2024-12-03

ALINUX2-SA-2024:0045: xerces-c security update (Important)

CVEs:CVE-2023-37536

Affected products

ProductStatusVendorPackageEcosystem
xerces-c affected Alibaba Cloud xerces-c
Upstream advisory

ALINUX2-SA-2024:0042

ALINUX 2Coalition ESS < 30%2024-12-02

ALINUX2-SA-2024:0042: NetworkManager-libreswan security update (Important)

CVEs:CVE-2024-9050

Affected products

ProductStatusVendorPackageEcosystem
NetworkManager-libreswan affected Alibaba Cloud NetworkManager-libreswan
Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.