ALAS-2012-062

Amazon Linux 1 Security Advisory: ALAS-2012-62
Advisory Release Date: 2012-04-05 12:49 Pacific
Advisory Updated Date: 2014-09-14 15:46 Pacific
Severity: Medium
Issue Overview:

A NULL pointer dereference flaw was found in the way OpenSSL parsed Secure/Multipurpose Internet Mail Extensions (S/MIME) messages. An attacker could use this flaw to crash an application that uses OpenSSL to decrypt or verify S/MIME messages. (CVE-2012-1165)

A flaw was found in the PKCS#7 and Cryptographic Message Syntax (CMS) implementations in OpenSSL. An attacker could possibly use this flaw to perform a Bleichenbacher attack to decrypt an encrypted CMS, PKCS#7, or S/MIME message by sending a large number of chosen ciphertext messages to a service using OpenSSL and measuring error response times. (CVE-2012-0884)


Affected Packages:

openssl


Issue Correction:
Run yum update openssl to update your system.

New Packages:
i686:
    openssl-devel-1.0.0g-2.39.amzn1.i686
    openssl-static-1.0.0g-2.39.amzn1.i686
    openssl-perl-1.0.0g-2.39.amzn1.i686
    openssl-debuginfo-1.0.0g-2.39.amzn1.i686
    openssl-1.0.0g-2.39.amzn1.i686

src:
    openssl-1.0.0g-2.39.amzn1.src

x86_64:
    openssl-1.0.0g-2.39.amzn1.x86_64
    openssl-static-1.0.0g-2.39.amzn1.x86_64
    openssl-debuginfo-1.0.0g-2.39.amzn1.x86_64
    openssl-perl-1.0.0g-2.39.amzn1.x86_64
    openssl-devel-1.0.0g-2.39.amzn1.x86_64

Additional References

Red Hat: CVE-2012-0884, CVE-2012-1165

Mitre: CVE-2012-0884, CVE-2012-1165