Amazon Linux 2 Security Advisory: ALAS-2018-996
Advisory Release Date: 2018-04-19 04:58 Pacific
Advisory Updated Date: 2018-04-20 00:19 Pacific
FAQs regarding Amazon Linux ALAS/CVE Severity
This update adds the checkHost option to stunnel, which verifies the host of the peer certificate subject. Certificates are accepted if no checkHost option was specified, or the host name of the peer certificate matches any of the hosts specified with checkHost.
This update adds the OCSPaia option to stunnel, which enables stunnel to validate certificates with the list of OCSP responder URLs retrieved from their AIA (Authority Information Access) extension.
This update adds the verify option to stunnel, which verifies the peer certificate. The different verification levels are as follows:
level 0 - request and ignore the peer certificate
level 1 - verify the peer certificate if present
level 2 - verify the peer certificate
level 3 - verify the peer against a locally installed certificate
level 4 - ignore the chain and only verify the peer certificate
default - no verify
Certificates for verification needs to be stored either in the file specified with CAfile, or in the directory specified with CApath.
This update enables amazon-efs-utils to use new features added to stunnel to encrypt data in transit to EFS
Affected Packages:
stunnel, amazon-efs-utils
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update stunnel to update your system.
Run yum update amazon-efs-utils to update your system.
noarch:
amazon-efs-utils-1.2-1.amzn2.noarch
src:
stunnel-4.56-6.amzn2.0.1.src
amazon-efs-utils-1.2-1.amzn2.src
x86_64:
stunnel-4.56-6.amzn2.0.1.x86_64
stunnel-debuginfo-4.56-6.amzn2.0.1.x86_64