Lucene search

K
amazonAmazonALAS-2011-004
HistoryOct 10, 2011 - 11:40 p.m.

Medium: openssl

2011-10-1023:40:00
alas.aws.amazon.com
16

0.013 Low

EPSS

Percentile

86.0%

Issue Overview:

An uninitialized variable use flaw was found in OpenSSL. This flaw could cause an application using the OpenSSL Certificate Revocation List (CRL) checking functionality to incorrectly accept a CRL that has a nextUpdate date in the past.

All OpenSSL users should upgrade to these updated packages, which contain a backported patch to resolve this issue. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.

Affected Packages:

openssl

Issue Correction:
Run yum update openssl to update your system.

New Packages:

i686:  
    openssl-static-1.0.0e-2.16.amzn1.i686  
    openssl-devel-1.0.0e-2.16.amzn1.i686  
    openssl-1.0.0e-2.16.amzn1.i686  
    openssl-debuginfo-1.0.0e-2.16.amzn1.i686  
    openssl-perl-1.0.0e-2.16.amzn1.i686  
  
src:  
    openssl-1.0.0e-2.16.amzn1.src  
  
x86_64:  
    openssl-perl-1.0.0e-2.16.amzn1.x86_64  
    openssl-debuginfo-1.0.0e-2.16.amzn1.x86_64  
    openssl-devel-1.0.0e-2.16.amzn1.x86_64  
    openssl-1.0.0e-2.16.amzn1.x86_64  
    openssl-static-1.0.0e-2.16.amzn1.x86_64  

Additional References

Red Hat: CVE-2011-3207

Mitre: CVE-2011-3207