Amazon Linux 1 Security Advisory: ALAS-2015-498
Advisory Release Date: 2015-03-23 13:42 Pacific
Advisory Updated Date: 2015-03-23 13:53 Pacific
FAQs regarding Amazon Linux ALAS/CVE Severity
A use-after-free flaw was found in the way OpenSSL importrf certain Elliptic Curve private keys. An attacker could use this flaw to crash OpenSSL, if a specially-crafted certificate was imported. (CVE-2015-0209)
A denial of service flaw was found in the way OpenSSL handled certain SSLv2 messages. A malicious client could send a specially crafted SSLv2 CLIENT-MASTER-KEY message that would cause an OpenSSL server that both supports SSLv2 and enables EXPORT-grade cipher suites to crash. (CVE-2015-0293)
An out-of-bounds write flaw was found in the way OpenSSL reused certain ASN.1 structures. A remote attacker could use a specially crafted ASN.1 structure that, when parsed by an application, would cause that application to crash. (CVE-2015-0287)
A flaw was found in the the ASN (Abstract Syntax Notation) parsing code of OpenSSL. An attacker could present a specially crafted certificate, which when verified by an OpenSSL client or server could cause it to crash. (CVE-2015-0286)
A null-pointer dereference was found in the way OpenSSL handled certain PKCS#7 blobs. An attacker could cause OpenSSL to crash, when applications verify, decrypt or parsed these ASN.1 encoded PKCS#7 blobs. OpenSSL clients and servers are not affected. (CVE-2015-0289)
A NULL pointer dereference flaw was found in OpenSSL's x509 certificate handling implementation. A remote attacker could use this flaw to crash an OpenSSL server using an invalid certificate key. (CVE-2015-0288)
Affected Packages:
openssl
Issue Correction:
Run yum update openssl to update your system.
i686:
openssl-debuginfo-1.0.1k-1.84.amzn1.i686
openssl-perl-1.0.1k-1.84.amzn1.i686
openssl-1.0.1k-1.84.amzn1.i686
openssl-devel-1.0.1k-1.84.amzn1.i686
openssl-static-1.0.1k-1.84.amzn1.i686
src:
openssl-1.0.1k-1.84.amzn1.src
x86_64:
openssl-static-1.0.1k-1.84.amzn1.x86_64
openssl-perl-1.0.1k-1.84.amzn1.x86_64
openssl-devel-1.0.1k-1.84.amzn1.x86_64
openssl-1.0.1k-1.84.amzn1.x86_64
openssl-debuginfo-1.0.1k-1.84.amzn1.x86_64