Amazon Linux AMI: CVE-2023-0464: Security patch for openssl (ALAS-2023-1762)

Amazon Linux AMI: CVE-2023-0464: Security patch for openssl (ALAS-2023-1762)

Severity

8

CVSS

(AV:N/AC:L/Au:N/C:N/I:N/A:C)

Published

03/22/2023

Created

06/12/2023

Added

06/09/2023

Modified

01/28/2025

Description

A security vulnerability has been identified in all supported versions

of OpenSSL related to the verification of X.509 certificate chains

that include policy constraints.Attackers may be able to exploit this

vulnerability by creating a malicious certificate chain that triggers

exponential use of computational resources, leading to a denial-of-service

(DoS) attack on affected systems.

Policy processing is disabled by default but can be enabled by passing

the `-policy' argument to the command line utilities or by calling the

`X509_VERIFY_PARAM_set1_policies()' function.

Solution(s)

• amazon-linux-upgrade-openssl

References

• ALAS-2023-1762
• CVE-2023-0464