Advisoriesby IbisAWSGHSA-h5p4-28rh-q272
Issue with parsing Certificate Common Name (CN) in s2n-tls
Fix: upgrade to v1.3.35 or later
An issue in s2n-tls results in skipping a certificate’s Common Name field validation if it exceeds 255 bytes. As a result, s2n-tls incorrectly validates a certificate that has a Common Name (CN) larger than 255 bytes, doesn’t have a Subject Alternative Name (SAN), and is signed by a trusted Certificate Authority (CA).
No AWS services are affected by this issue and customers of AWS services do not need to take action. Client applications using s2n-tls should upgrade their application to the most recent release of s2n-tls.
Impacted versions: All versions of s2n-tls from commit e954e6e through commit 4bd1505. Affected s2n-tls users should fetch s2n-tls commit a58b308 or later.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| s2n-tls Product | < v1.3.35 | v1.3.35 |
Details and references
- Severity from
- GitHub (reviewed advisory)
More AWS advisories
All AWS
Potential denial of service after connection migrationGHSA-rfhg-rjfp-9q8qfixed in v1.25.0Potential denial of service when receiving empty UDP packetsGHSA-hxq4-mx37-fqvgfixed in v1.23.0EKS overly permissive trust policiesCVE-2023-35165fixed in 2.80.0 +1Privilege Escalation Vector in CloudWatch Agent for WindowsCVE-2022-23511fixed in 1.247355Issue with configuring session ticket names in s2n-tlsGHSA-m74w-59v6-c5r8fixed in v1.3.23Server denial-of-service by using sslv2 message format in a HelloRetryRequest handshakeGHSA-mm47-wjfh-4hf5fixed in <v1.3.23