Skip to content
OpenAdvisories
High ALAS2-2020-1573 1 CVE

Important: openssl security update (Amazon Linux 2)

Published Dec 8, 2020 · Updated Dec 8, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-1971: A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability. 1903409: CVE-2020-1971 openssl: EDIPARTYNAME NULL pointer de-reference

Fixed packages 11

ReleasePackageFixed in
Amazon Linux · 2 openssl 1:1.0.2k-19.amzn2.0.4
Amazon Linux · 2 openssl-debuginfo 1:1.0.2k-19.amzn2.0.4
Amazon Linux · 2 openssl-devel 1:1.0.2k-19.amzn2.0.4
Amazon Linux · 2 openssl-libs 1:1.0.2k-19.amzn2.0.4
Amazon Linux · 2 openssl-perl 1:1.0.2k-19.amzn2.0.4
Amazon Linux · 2 openssl-static 1:1.0.2k-19.amzn2.0.4
Amazon Linux · 2 openssl11 1:1.1.1c-15.amzn2.0.2
Amazon Linux · 2 openssl11-debuginfo 1:1.1.1c-15.amzn2.0.2
Amazon Linux · 2 openssl11-devel 1:1.1.1c-15.amzn2.0.2
Amazon Linux · 2 openssl11-libs 1:1.1.1c-15.amzn2.0.2
Amazon Linux · 2 openssl11-static 1:1.1.1c-15.amzn2.0.2

Vulnerabilities 1

  • Medium 5.9
    CVE-2020-1971 Public exploit

    EDIPARTYNAME NULL pointer dereference

    The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equa…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-1971.html