Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-1551: An integer overflow was found in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. As per upstream: * No EC algorithms are affected. * Attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. * Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. * Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME 1780995: CVE-2019-1551 openssl: Integer overflow in RSAZ modular exponentiation on x86_64
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | openssl | 1:1.0.2k-19.amzn2.0.7 |
| Amazon Linux · 2 | openssl-debuginfo | 1:1.0.2k-19.amzn2.0.7 |
| Amazon Linux · 2 | openssl-devel | 1:1.0.2k-19.amzn2.0.7 |
| Amazon Linux · 2 | openssl-libs | 1:1.0.2k-19.amzn2.0.7 |
| Amazon Linux · 2 | openssl-perl | 1:1.0.2k-19.amzn2.0.7 |
| Amazon Linux · 2 | openssl-static | 1:1.0.2k-19.amzn2.0.7 |
Vulnerabilities 1
-
Unscored —CVE-2019-1551 EPSS 14%
rsaz_512_sqr overflow bug on x86_64
There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect wou…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-1551.html