Skip to content
OpenAdvisories
Low ALAS2-2021-1687 1 CVE

Low: openssl security update (Amazon Linux 2)

Published Jul 14, 2021 · Updated Jul 15, 2021

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-1551: An integer overflow was found in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. As per upstream: * No EC algorithms are affected. * Attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. * Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. * Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME 1780995: CVE-2019-1551 openssl: Integer overflow in RSAZ modular exponentiation on x86_64

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 openssl 1:1.0.2k-19.amzn2.0.7
Amazon Linux · 2 openssl-debuginfo 1:1.0.2k-19.amzn2.0.7
Amazon Linux · 2 openssl-devel 1:1.0.2k-19.amzn2.0.7
Amazon Linux · 2 openssl-libs 1:1.0.2k-19.amzn2.0.7
Amazon Linux · 2 openssl-perl 1:1.0.2k-19.amzn2.0.7
Amazon Linux · 2 openssl-static 1:1.0.2k-19.amzn2.0.7

Vulnerabilities 1

  • Unscored —
    CVE-2019-1551 EPSS 14%

    rsaz_512_sqr overflow bug on x86_64

    There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect wou…

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-1551.html