Skip to content
OpenAdvisories
Low ALAS2-2019-1153 1 CVE

Low: openssl security update (Amazon Linux 2)

Published Jan 23, 2019 · Updated Jan 25, 2019

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-0734: The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p). 1644364: CVE-2018-0734 openssl: timing side channel attack in the DSA signature algorithm

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 openssl 1:1.0.2k-16.amzn2.0.2
Amazon Linux · 2 openssl-debuginfo 1:1.0.2k-16.amzn2.0.2
Amazon Linux · 2 openssl-devel 1:1.0.2k-16.amzn2.0.2
Amazon Linux · 2 openssl-libs 1:1.0.2k-16.amzn2.0.2
Amazon Linux · 2 openssl-perl 1:1.0.2k-16.amzn2.0.2
Amazon Linux · 2 openssl-static 1:1.0.2k-16.amzn2.0.2

Vulnerabilities 1

  • Unscored —
    CVE-2018-0734 EPSS 12%

    Timing attack against DSA

    The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affec…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-0734.html