Skip to content
OpenAdvisories
Low ALAS2-2024-2478 1 CVE

Low: openssl11 security update (Amazon Linux 2)

Published Feb 29, 2024 · Updated Mar 4, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-0727: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack The package openssl098e is provided purely for binary compatibility with older Amazon Linux versions. It does not receive security updates.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 openssl11 1:1.1.1g-12.amzn2.0.20
Amazon Linux · 2 openssl11-debuginfo 1:1.1.1g-12.amzn2.0.20
Amazon Linux · 2 openssl11-devel 1:1.1.1g-12.amzn2.0.20
Amazon Linux · 2 openssl11-libs 1:1.1.1g-12.amzn2.0.20
Amazon Linux · 2 openssl11-static 1:1.1.1g-12.amzn2.0.20

Vulnerabilities 1

  • Medium 5.5
    CVE-2024-0727

    PKCS12 Decoding crashes

    Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-0727.html