Skip to content
OpenAdvisories
High ALAS2023-2026-2034 1 CVE

Important: aws-nitro-enclaves-cli security update (Amazon Linux 2023)

Published Aug 3, 2026 · Updated Aug 4, 2026

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-42327: rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref<Target = str> wraps the raw bytes with str::from_utf8_unchecked. OpenSSL does not enforce that the underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes in its OCSP accessLocation causes safe Rust code to construct a &str that violates the UTF-8 invariant -- resulting in undefined behavior. This vulnerability is fixed in 0.10.79.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2023 aws-nitro-enclaves-cli 0:1.4.5-0.amzn2023
Amazon Linux · 2023 aws-nitro-enclaves-cli-devel 0:1.4.5-0.amzn2023
Amazon Linux · 2023 aws-nitro-enclaves-cli-integration-tests 0:1.4.5-0.amzn2023

Vulnerabilities 1

  • High 8.7

    rust-openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs

    rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref<Target = str> wraps the raw bytes wit…

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-42327.html