Skip to content
OpenAdvisories
Low ALAS2-2024-2479 1 CVE

Low: openssl security update (Amazon Linux 2)

Published Feb 29, 2024 · Updated Mar 4, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-0727: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack The package openssl098e is provided purely for binary compatibility with older Amazon Linux versions. It does not receive security updates.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 openssl 1:1.0.2k-24.amzn2.0.12
Amazon Linux · 2 openssl-debuginfo 1:1.0.2k-24.amzn2.0.12
Amazon Linux · 2 openssl-devel 1:1.0.2k-24.amzn2.0.12
Amazon Linux · 2 openssl-libs 1:1.0.2k-24.amzn2.0.12
Amazon Linux · 2 openssl-perl 1:1.0.2k-24.amzn2.0.12
Amazon Linux · 2 openssl-static 1:1.0.2k-24.amzn2.0.12

Vulnerabilities 1

  • Medium 5.5
    CVE-2024-0727

    PKCS12 Decoding crashes

    Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-0727.html