CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS
Percentile
96.2%
Issue Overview:
It was discovered that the Datagram Transport Layer Security (DTLS) protocol implementation in OpenSSL leaked timing information when performing certain operations. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a DTLS server as a padding oracle. (CVE-2011-4108)
An information leak flaw was found in the SSL 3.0 protocol implementation in OpenSSL. Incorrect initialization of SSL record padding bytes could cause an SSL client or server to send a limited amount of possibly sensitive data to its SSL peer via the encrypted connection. (CVE-2011-4576)
A denial of service flaw was found in the RFC 3779 implementation in OpenSSL. A remote attacker could use this flaw to make an application using OpenSSL exit unexpectedly by providing a specially-crafted X.509 certificate that has malformed RFC 3779 extension data. (CVE-2011-4577)
It was discovered that OpenSSL did not limit the number of TLS/SSL handshake restarts required to support Server Gated Cryptography. A remote attacker could use this flaw to make a TLS/SSL server using OpenSSL consume an excessive amount of CPU by continuously restarting the handshake. (CVE-2011-4619)
Affected Packages:
openssl
Issue Correction:
Run yum update openssl to update your system.
New Packages:
i686:
openssl-1.0.0g-1.26.amzn1.i686
openssl-perl-1.0.0g-1.26.amzn1.i686
openssl-devel-1.0.0g-1.26.amzn1.i686
openssl-debuginfo-1.0.0g-1.26.amzn1.i686
openssl-static-1.0.0g-1.26.amzn1.i686
src:
openssl-1.0.0g-1.26.amzn1.src
x86_64:
openssl-static-1.0.0g-1.26.amzn1.x86_64
openssl-debuginfo-1.0.0g-1.26.amzn1.x86_64
openssl-devel-1.0.0g-1.26.amzn1.x86_64
openssl-perl-1.0.0g-1.26.amzn1.x86_64
openssl-1.0.0g-1.26.amzn1.x86_64
Red Hat: CVE-2011-4108, CVE-2011-4576, CVE-2011-4577, CVE-2011-4619
Mitre: CVE-2011-4108, CVE-2011-4576, CVE-2011-4577, CVE-2011-4619
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Amazon Linux | 1 | i686 | openssl | < 1.0.0g-1.26.amzn1 | openssl-1.0.0g-1.26.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | openssl-perl | < 1.0.0g-1.26.amzn1 | openssl-perl-1.0.0g-1.26.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | openssl-devel | < 1.0.0g-1.26.amzn1 | openssl-devel-1.0.0g-1.26.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | openssl-debuginfo | < 1.0.0g-1.26.amzn1 | openssl-debuginfo-1.0.0g-1.26.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | openssl-static | < 1.0.0g-1.26.amzn1 | openssl-static-1.0.0g-1.26.amzn1.i686.rpm |
Amazon Linux | 1 | x86_64 | openssl-static | < 1.0.0g-1.26.amzn1 | openssl-static-1.0.0g-1.26.amzn1.x86_64.rpm |
Amazon Linux | 1 | x86_64 | openssl-debuginfo | < 1.0.0g-1.26.amzn1 | openssl-debuginfo-1.0.0g-1.26.amzn1.x86_64.rpm |
Amazon Linux | 1 | x86_64 | openssl-devel | < 1.0.0g-1.26.amzn1 | openssl-devel-1.0.0g-1.26.amzn1.x86_64.rpm |
Amazon Linux | 1 | x86_64 | openssl-perl | < 1.0.0g-1.26.amzn1 | openssl-perl-1.0.0g-1.26.amzn1.x86_64.rpm |
Amazon Linux | 1 | x86_64 | openssl | < 1.0.0g-1.26.amzn1 | openssl-1.0.0g-1.26.amzn1.x86_64.rpm |