Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3450: A flaw was found in openssl. The flag that enables additional security checks of certificates present in a certificate chain was not enabled allowing a confirmation step to verify that certificates in the chain are valid CA certificates is bypassed. The highest threat from this vulnerability is to data confidentiality and integrity. 1941547: CVE-2021-3450 openssl: CA certificate check bypass with X509_V_FLAG_X509_STRICT CVE-2021-3449: A flaw was found in openssl. A server crash and denial of service attack could occur if a client sends a TLSv1.2 renegotiation ClientHello and omits the signature_algorithms extension but includes a signature_algorithms_cert extension. The highest threat from this vulnerability is to system availability. 1941554: CVE-2021-3449 openssl: NULL pointer deref in signature_algorithms processing
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | openssl11 | 1:1.1.1g-12.amzn2.0.3 |
| Amazon Linux · 2 | openssl11-debuginfo | 1:1.1.1g-12.amzn2.0.3 |
| Amazon Linux · 2 | openssl11-devel | 1:1.1.1g-12.amzn2.0.3 |
| Amazon Linux · 2 | openssl11-libs | 1:1.1.1g-12.amzn2.0.3 |
| Amazon Linux · 2 | openssl11-static | 1:1.1.1g-12.amzn2.0.3 |
Vulnerabilities 2
-
High 7.4
CA certificate check bypass with X509_V_FLAG_X509_STRICT
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded e…
-
Medium 5.9
NULL pointer deref in signature_algorithms processing
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a si…