ALAS-2022-195

A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the `c_rehash` script where it possibly passed the file names of certificates being hashed to a command executed through the shell. Some operating systems distribute this script in a manner where it is automatically executed. On these operating systems, this flaw allows an attacker to execute arbitrary commands with the privileges of the script. (CVE-2022-2068)

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimized implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. (CVE-2022-2097)

aarch64:
    openssl-debuginfo-3.0.5-1.amzn2022.0.2.aarch64
    openssl-libs-debuginfo-3.0.5-1.amzn2022.0.2.aarch64
    openssl-perl-3.0.5-1.amzn2022.0.2.aarch64
    openssl-libs-3.0.5-1.amzn2022.0.2.aarch64
    openssl-3.0.5-1.amzn2022.0.2.aarch64
    openssl-debugsource-3.0.5-1.amzn2022.0.2.aarch64
    openssl-devel-3.0.5-1.amzn2022.0.2.aarch64

src:
    openssl-3.0.5-1.amzn2022.0.2.src

x86_64:
    openssl-libs-debuginfo-3.0.5-1.amzn2022.0.2.x86_64
    openssl-perl-3.0.5-1.amzn2022.0.2.x86_64
    openssl-debuginfo-3.0.5-1.amzn2022.0.2.x86_64
    openssl-libs-3.0.5-1.amzn2022.0.2.x86_64
    openssl-3.0.5-1.amzn2022.0.2.x86_64
    openssl-debugsource-3.0.5-1.amzn2022.0.2.x86_64
    openssl-devel-3.0.5-1.amzn2022.0.2.x86_64