Skip to content
OpenAdvisories
Medium ALAS2-2022-1832 1 CVE

Moderate: openssl11 security update (Amazon Linux 2)

Published Jul 28, 2022 · Updated Aug 8, 2022

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-2068: A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the `c_rehash` script where it possibly passed the file names of certificates being hashed to a command executed through the shell. Some operating systems distribute this script in a manner where it is automatically executed. On these operating systems, this flaw allows an attacker to execute arbitrary commands with the privileges of the script.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 openssl11 1:1.1.1g-12.amzn2.0.9
Amazon Linux · 2 openssl11-debuginfo 1:1.1.1g-12.amzn2.0.9
Amazon Linux · 2 openssl11-devel 1:1.1.1g-12.amzn2.0.9
Amazon Linux · 2 openssl11-libs 1:1.1.1g-12.amzn2.0.9
Amazon Linux · 2 openssl11-static 1:1.1.1g-12.amzn2.0.9

Vulnerabilities 1

  • Critical 9.8
    CVE-2022-2068 EPSS 96%

    The c_rehash script allows command injection

    In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-2068.html