Amazon Linux 1 Security Advisory: ALAS-2012-62
Advisory Release Date: 2012-04-05 12:49 Pacific
Advisory Updated Date: 2014-09-14 15:46 Pacific
FAQs regarding Amazon Linux ALAS/CVE Severity
A NULL pointer dereference flaw was found in the way OpenSSL parsed Secure/Multipurpose Internet Mail Extensions (S/MIME) messages. An attacker could use this flaw to crash an application that uses OpenSSL to decrypt or verify S/MIME messages. (CVE-2012-1165)
A flaw was found in the PKCS#7 and Cryptographic Message Syntax (CMS) implementations in OpenSSL. An attacker could possibly use this flaw to perform a Bleichenbacher attack to decrypt an encrypted CMS, PKCS#7, or S/MIME message by sending a large number of chosen ciphertext messages to a service using OpenSSL and measuring error response times. (CVE-2012-0884)
Affected Packages:
openssl
Issue Correction:
Run yum update openssl to update your system.
i686:
openssl-devel-1.0.0g-2.39.amzn1.i686
openssl-static-1.0.0g-2.39.amzn1.i686
openssl-perl-1.0.0g-2.39.amzn1.i686
openssl-debuginfo-1.0.0g-2.39.amzn1.i686
openssl-1.0.0g-2.39.amzn1.i686
src:
openssl-1.0.0g-2.39.amzn1.src
x86_64:
openssl-1.0.0g-2.39.amzn1.x86_64
openssl-static-1.0.0g-2.39.amzn1.x86_64
openssl-debuginfo-1.0.0g-2.39.amzn1.x86_64
openssl-perl-1.0.0g-2.39.amzn1.x86_64
openssl-devel-1.0.0g-2.39.amzn1.x86_64