Skip to content
OpenAdvisories
Medium ALAS2-2021-1721 1 CVE

Moderate: openssl security update (Amazon Linux 2)

Published Oct 26, 2021 · Updated Nov 4, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3712: It was found that openssl assumed ASN.1 strings to be NUL terminated. A malicious actor may be able to force an application into calling openssl function with a specially crafted, non-NUL terminated string to deliberately hit this bug, which may result in a crash of the application, causing a Denial of Service attack, or possibly, memory disclosure. The highest threat from this vulnerability is to data confidentiality and system availability. 1995634: CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 openssl 1:1.0.2k-19.amzn2.0.8
Amazon Linux · 2 openssl-debuginfo 1:1.0.2k-19.amzn2.0.8
Amazon Linux · 2 openssl-devel 1:1.0.2k-19.amzn2.0.8
Amazon Linux · 2 openssl-libs 1:1.0.2k-19.amzn2.0.8
Amazon Linux · 2 openssl-perl 1:1.0.2k-19.amzn2.0.8
Amazon Linux · 2 openssl-static 1:1.0.2k-19.amzn2.0.8

Vulnerabilities 1

  • High 7.4
    CVE-2021-3712 Public exploit EPSS 48%

    Read buffer overruns processing ASN.1 strings

    ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string dat…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-3712.html