Skip to content
OpenAdvisories
Low ALAS2023-2023-095 1 CVE

Low: openssl security update (Amazon Linux 2023)

Published Feb 17, 2023 · Updated Feb 22, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-3996: If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the `-policy' argument to the command line utilities or by calling either `X509_VERIFY_PARAM_add0_policy()' or `X509_VERIFY_PARAM_set1_policies()' functions.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2023 openssl 1:3.0.5-1.amzn2023.0.7
Amazon Linux · 2023 openssl-debuginfo 1:3.0.5-1.amzn2023.0.7
Amazon Linux · 2023 openssl-debugsource 1:3.0.5-1.amzn2023.0.7
Amazon Linux · 2023 openssl-devel 1:3.0.5-1.amzn2023.0.7
Amazon Linux · 2023 openssl-libs 1:3.0.5-1.amzn2023.0.7
Amazon Linux · 2023 openssl-libs-debuginfo 1:3.0.5-1.amzn2023.0.7
Amazon Linux · 2023 openssl-perl 1:3.0.5-1.amzn2023.0.7

Vulnerabilities 1

  • High 7.5
    CVE-2022-3996

    X.509 Policy Constraints Double Locking

    If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine Wolfi crates.io

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-3996.html