Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-15467: A flaw was found in OpenSSL. A remote attacker can exploit a stack buffer overflow vulnerability by supplying a crafted Cryptographic Message Syntax (CMS) message with an oversized Initialization Vector (IV) when parsing AuthEnvelopedData structures that use Authenticated Encryption with Associated Data (AEAD) ciphers such as AES-GCM. This can lead to a crash, causing a Denial of Service (DoS), or potentially allow for remote code execution.
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | openssl | 1:3.2.2-1.amzn2023.0.4 |
| Amazon Linux · 2023 | openssl-debuginfo | 1:3.2.2-1.amzn2023.0.4 |
| Amazon Linux · 2023 | openssl-debugsource | 1:3.2.2-1.amzn2023.0.4 |
| Amazon Linux · 2023 | openssl-devel | 1:3.2.2-1.amzn2023.0.4 |
| Amazon Linux · 2023 | openssl-fips-provider-latest | 1:3.2.2-1.amzn2023.0.4 |
| Amazon Linux · 2023 | openssl-fips-provider-latest-debuginfo | 1:3.2.2-1.amzn2023.0.4 |
| Amazon Linux · 2023 | openssl-libs | 1:3.2.2-1.amzn2023.0.4 |
| Amazon Linux · 2023 | openssl-libs-debuginfo | 1:3.2.2-1.amzn2023.0.4 |
| Amazon Linux · 2023 | openssl-perl | 1:3.2.2-1.amzn2023.0.4 |
| Amazon Linux · 2023 | openssl-snapsafe-libs | 1:3.2.2-1.amzn2023.0.4 |
| Amazon Linux · 2023 | openssl-snapsafe-libs-debuginfo | 1:3.2.2-1.amzn2023.0.4 |
Vulnerabilities 1
-
High 8.8
Stack buffer overflow in CMS (Auth)EnvelopedData parsing
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote c…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-15467.html