ALAS2023-2026-1586

References: CVE-2026-28387  CVE-2026-28388  CVE-2026-28389  CVE-2026-28390  CVE-2026-31790 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Potential use-after-free in DANE client code (CVE-2026-28387)

NULL Pointer Dereference When Processing a Delta CRL

NOTE: https://openssl-library.org/news/secadv/20260407.txt (CVE-2026-28388)

Possible NULL dereference when processing CMS KeyAgreeRecipientInfo (CVE-2026-28389)

Possible NULL dereference when processing CMS KeyTransportRecipientInfo (CVE-2026-28390)

Incorrect failure handling in RSA KEM RSASVE encapsulation (CVE-2026-31790)

Issue Correction:
Run dnf update openssl --releasever 2023.11.20260413 or dnf update --advisory ALAS2023-2026-1586 --releasever 2023.11.20260413 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    openssl-debuginfo-3.5.5-1.amzn2023.0.4.aarch64
    openssl-fips-provider-latest-debuginfo-3.5.5-1.amzn2023.0.4.aarch64
    openssl-snapsafe-libs-debuginfo-3.5.5-1.amzn2023.0.4.aarch64
    openssl-fips-provider-latest-3.5.5-1.amzn2023.0.4.aarch64
    openssl-libs-debuginfo-3.5.5-1.amzn2023.0.4.aarch64
    openssl-perl-3.5.5-1.amzn2023.0.4.aarch64
    openssl-snapsafe-libs-3.5.5-1.amzn2023.0.4.aarch64
    openssl-3.5.5-1.amzn2023.0.4.aarch64
    openssl-libs-3.5.5-1.amzn2023.0.4.aarch64
    openssl-debugsource-3.5.5-1.amzn2023.0.4.aarch64
    openssl-devel-3.5.5-1.amzn2023.0.4.aarch64

src:
    openssl-3.5.5-1.amzn2023.0.4.src

x86_64:
    openssl-fips-provider-latest-debuginfo-3.5.5-1.amzn2023.0.4.x86_64
    openssl-fips-provider-latest-3.5.5-1.amzn2023.0.4.x86_64
    openssl-libs-debuginfo-3.5.5-1.amzn2023.0.4.x86_64
    openssl-snapsafe-libs-debuginfo-3.5.5-1.amzn2023.0.4.x86_64
    openssl-debuginfo-3.5.5-1.amzn2023.0.4.x86_64
    openssl-perl-3.5.5-1.amzn2023.0.4.x86_64
    openssl-snapsafe-libs-3.5.5-1.amzn2023.0.4.x86_64
    openssl-libs-3.5.5-1.amzn2023.0.4.x86_64
    openssl-debugsource-3.5.5-1.amzn2023.0.4.x86_64
    openssl-3.5.5-1.amzn2023.0.4.x86_64
    openssl-devel-3.5.5-1.amzn2023.0.4.x86_64