Skip to content
OpenAdvisories
High ALAS2023-2023-406 1 CVE

Important: openssl security update (Amazon Linux 2023)

Published Oct 30, 2023 · Updated Nov 3, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-5363: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. A truncation in the IV can result in non-uniqueness, which could result in loss of confidentiality for some cipher modes.

Fixed packages 9

ReleasePackageFixed in
Amazon Linux · 2023 openssl 1:3.0.8-1.amzn2023.0.9
Amazon Linux · 2023 openssl-debuginfo 1:3.0.8-1.amzn2023.0.9
Amazon Linux · 2023 openssl-debugsource 1:3.0.8-1.amzn2023.0.9
Amazon Linux · 2023 openssl-devel 1:3.0.8-1.amzn2023.0.9
Amazon Linux · 2023 openssl-libs 1:3.0.8-1.amzn2023.0.9
Amazon Linux · 2023 openssl-libs-debuginfo 1:3.0.8-1.amzn2023.0.9
Amazon Linux · 2023 openssl-perl 1:3.0.8-1.amzn2023.0.9
Amazon Linux · 2023 openssl-snapsafe-libs 1:3.0.8-1.amzn2023.0.9
Amazon Linux · 2023 openssl-snapsafe-libs-debuginfo 1:3.0.8-1.amzn2023.0.9

Vulnerabilities 1

  • High 7.5
    CVE-2023-5363

    Incorrect cipher key & IV length processing

    Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-5363.html