logo
DATABASE RESOURCES PRICING ABOUT US

Medium: openssl

Description

**Issue Overview:** It was discovered that the Datagram Transport Layer Security (DTLS) protocol implementation in OpenSSL leaked timing information when performing certain operations. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a DTLS server as a padding oracle. (CVE-2011-4108) An information leak flaw was found in the SSL 3.0 protocol implementation in OpenSSL. Incorrect initialization of SSL record padding bytes could cause an SSL client or server to send a limited amount of possibly sensitive data to its SSL peer via the encrypted connection. (CVE-2011-4576) A denial of service flaw was found in the RFC 3779 implementation in OpenSSL. A remote attacker could use this flaw to make an application using OpenSSL exit unexpectedly by providing a specially-crafted X.509 certificate that has malformed RFC 3779 extension data. (CVE-2011-4577) It was discovered that OpenSSL did not limit the number of TLS/SSL handshake restarts required to support Server Gated Cryptography. A remote attacker could use this flaw to make a TLS/SSL server using OpenSSL consume an excessive amount of CPU by continuously restarting the handshake. (CVE-2011-4619) **Affected Packages:** openssl **Issue Correction:** Run _yum update openssl_ to update your system. **New Packages:** i686:     openssl-1.0.0g-1.26.amzn1.i686     openssl-perl-1.0.0g-1.26.amzn1.i686     openssl-devel-1.0.0g-1.26.amzn1.i686     openssl-debuginfo-1.0.0g-1.26.amzn1.i686     openssl-static-1.0.0g-1.26.amzn1.i686 src:     openssl-1.0.0g-1.26.amzn1.src x86_64:     openssl-static-1.0.0g-1.26.amzn1.x86_64     openssl-debuginfo-1.0.0g-1.26.amzn1.x86_64     openssl-devel-1.0.0g-1.26.amzn1.x86_64     openssl-perl-1.0.0g-1.26.amzn1.x86_64     openssl-1.0.0g-1.26.amzn1.x86_64


Affected Package


OS OS Version Package Name Package Version
Amazon Linux 1 openssl 1.0.0g-1.26.amzn1
Amazon Linux 1 openssl-perl 1.0.0g-1.26.amzn1
Amazon Linux 1 openssl-devel 1.0.0g-1.26.amzn1
Amazon Linux 1 openssl-debuginfo 1.0.0g-1.26.amzn1
Amazon Linux 1 openssl-static 1.0.0g-1.26.amzn1
Amazon Linux 1 openssl 1.0.0g-1.26.amzn1
Amazon Linux 1 openssl-static 1.0.0g-1.26.amzn1
Amazon Linux 1 openssl-debuginfo 1.0.0g-1.26.amzn1
Amazon Linux 1 openssl-devel 1.0.0g-1.26.amzn1
Amazon Linux 1 openssl-perl 1.0.0g-1.26.amzn1
Amazon Linux 1 openssl 1.0.0g-1.26.amzn1

Related