Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-42327: rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref<Target = str> wraps the raw bytes with str::from_utf8_unchecked. OpenSSL does not enforce that the underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes in its OCSP accessLocation causes safe Rust code to construct a &str that violates the UTF-8 invariant -- resulting in undefined behavior. This vulnerability is fixed in 0.10.79.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | aws-nitro-enclaves-cli | 0:1.4.5-0.amzn2023 |
| Amazon Linux · 2023 | aws-nitro-enclaves-cli-devel | 0:1.4.5-0.amzn2023 |
| Amazon Linux · 2023 | aws-nitro-enclaves-cli-integration-tests | 0:1.4.5-0.amzn2023 |
Vulnerabilities 1
-
High 8.7
rust-openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref<Target = str> wraps the raw bytes wit…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-42327.html