Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact s2n-tls uses the Linux atexit function to register functions that clean up the global state when the process exits. In multi-threaded environments, the atexit handler may clean up state which is still in use by other threads. When this occurs, the exiting process may experience a segmentation fault or other undefined behavior. Customers of AWS services do not need to take action. Applications using s2n-tls should upgrade to the most recent release of s2n-tls. Impacted versions: < v1.5.9. Patches The patch commit 493b771 is included in s2n-tls v1.5.9 [1] Workarounds The atexit handler may be disabled by calling s2ndisableatexit() prior to initializing s2n-tls. The atexit handler is off by default in the patched versions. For further details, refer to s2n-tls Usage Guide: Initialization and Teardown. If you have any questions or comments about this advisory, we ask that you contact AWS/Amazon Security via our vulnerability reporting page [2] or directly via email to…
Recommended action: Upgrade to 0.3.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An API ordering issue in s2n-tls can cause client authentication to unexpectedly not be enabled on the server when it otherwise appears to be. Server applications are impacted if client authentication is enabled by calling s2nconnectionsetconfig() before calling s2nconnectionsetclientauthtype(). Applications are not impacted if these APIs are called in the opposite order, or if client authentication is enabled on the config with s2nconfigsetclientauthtype(). s2n-tls clients verifying server certificates are not impacted. Impacted versions: < v1.5.0. Patches The patch is included in v1.5.0 [1]. Workarounds Applications can workaround this issue by calling s2nconnectionsetconfig() after calling s2nconnectionsetclientauthtype(), or by enabling client authentication on the config with s2nconfigsetclientauthtype(). If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [2] or directly via email to…
Recommended action: Upgrade to 0.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When receiving a message from a client that sent an invalid RSA premaster secret, an issue in s2n-tls results in the server performing additional processing when the premaster secret contains an incorrect client hello version. While no practical attack on s2n-tls has been demonstrated, this causes a small timing difference which could theoretically be used as described in the Marvin Attack [1]. We would like to thank Hubert Kario [2] for reporting this issue. Impact The extent of this issue is a timing difference. No practical attack on s2n-tls has been demonstrated. This issue affects server applications that permit RSA key exchange. Applications that use the default, built-in blinding feature or properly implement self-service blinding are not affected. Impacted versions: <= v1.4.15. Patches The patch is included in v1.4.16 [3]. Workarounds Applications can work around this issue by using an s2n-tls security policy that disallows RSA key exchange. If you have any questions or…
Recommended action: Upgrade to 0.2.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.