5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.114 Low
EPSS
Percentile
95.2%
Issue Overview:
A NULL pointer dereference flaw was found in the way OpenSSL parsed Secure/Multipurpose Internet Mail Extensions (S/MIME) messages. An attacker could use this flaw to crash an application that uses OpenSSL to decrypt or verify S/MIME messages. (CVE-2012-1165)
A flaw was found in the PKCS#7 and Cryptographic Message Syntax (CMS) implementations in OpenSSL. An attacker could possibly use this flaw to perform a Bleichenbacher attack to decrypt an encrypted CMS, PKCS#7, or S/MIME message by sending a large number of chosen ciphertext messages to a service using OpenSSL and measuring error response times. (CVE-2012-0884)
Affected Packages:
openssl
Issue Correction:
Run yum update openssl to update your system.
New Packages:
i686:
openssl-devel-1.0.0g-2.39.amzn1.i686
openssl-static-1.0.0g-2.39.amzn1.i686
openssl-perl-1.0.0g-2.39.amzn1.i686
openssl-debuginfo-1.0.0g-2.39.amzn1.i686
openssl-1.0.0g-2.39.amzn1.i686
src:
openssl-1.0.0g-2.39.amzn1.src
x86_64:
openssl-1.0.0g-2.39.amzn1.x86_64
openssl-static-1.0.0g-2.39.amzn1.x86_64
openssl-debuginfo-1.0.0g-2.39.amzn1.x86_64
openssl-perl-1.0.0g-2.39.amzn1.x86_64
openssl-devel-1.0.0g-2.39.amzn1.x86_64
Red Hat: CVE-2012-0884, CVE-2012-1165
Mitre: CVE-2012-0884, CVE-2012-1165
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Amazon Linux | 1 | i686 | openssl-devel | < 1.0.0g-2.39.amzn1 | openssl-devel-1.0.0g-2.39.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | openssl-static | < 1.0.0g-2.39.amzn1 | openssl-static-1.0.0g-2.39.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | openssl-perl | < 1.0.0g-2.39.amzn1 | openssl-perl-1.0.0g-2.39.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | openssl-debuginfo | < 1.0.0g-2.39.amzn1 | openssl-debuginfo-1.0.0g-2.39.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | openssl | < 1.0.0g-2.39.amzn1 | openssl-1.0.0g-2.39.amzn1.i686.rpm |
Amazon Linux | 1 | x86_64 | openssl | < 1.0.0g-2.39.amzn1 | openssl-1.0.0g-2.39.amzn1.x86_64.rpm |
Amazon Linux | 1 | x86_64 | openssl-static | < 1.0.0g-2.39.amzn1 | openssl-static-1.0.0g-2.39.amzn1.x86_64.rpm |
Amazon Linux | 1 | x86_64 | openssl-debuginfo | < 1.0.0g-2.39.amzn1 | openssl-debuginfo-1.0.0g-2.39.amzn1.x86_64.rpm |
Amazon Linux | 1 | x86_64 | openssl-perl | < 1.0.0g-2.39.amzn1 | openssl-perl-1.0.0g-2.39.amzn1.x86_64.rpm |
Amazon Linux | 1 | x86_64 | openssl-devel | < 1.0.0g-2.39.amzn1 | openssl-devel-1.0.0g-2.39.amzn1.x86_64.rpm |