It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-520 advisory.

    A flaw was found in OpenSSL. When the EVP_PKEY_public_check() function is called in RSA public keys, a     computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product     of two or more large primes and this computation completes quickly. However, if n is a large prime, this     computation takes a long time. An application that calls EVP_PKEY_public_check() and supplies an RSA key     obtained from an untrusted source could be vulnerable to a Denial of Service attack. (CVE-2023-6237)

    Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of     Service attack

    The package openssl098e is provided purely for binary compatibility with older Amazon Linux versions. It     does not receive security updates. (CVE-2024-0727)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2024-520)

medium Nessus Plugin ID 190742

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.3 Dec 12, 2024, 9:55 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202412120955
Version 1.2 Apr 11, 2024, 4:12 PM IAVM reference Plugin Feed: 202404111612
Version 1.1 Mar 8, 2024, 6:26 PM IAVM reference STIG Severity (set to "I") Plugin Feed: 202403081826
Version 1.0 Feb 20, 2024, 8:32 AM New Plugin Feed: 202402200832