Amazon Linux Security Advisory for openssl: ALAS-2016-749

A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support.

(Note: The OpenSSL Security Advisory [22 Sep 2016] refers to additional CVEs. CVE-2016-6305 does not affect OpenSSL 1.0.1. The remaining CVEs listed will be fixed in a later update.)

Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.

Please refer to Amazon advisory ALAS-2016-749 for affected packages and patching details, or update with your package manager.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ALAS-2016-749: Amazon Linux (openssl (1.0.1k-15.95.amzn1) on i686)

ALAS-2016-749: Amazon Linux (openssl (1.0.1k-15.95.amzn1) on x86_64)

ALAS-2016-749: Amazon Linux (openssl (1.0.1k-15.95.amzn1) on src)