Amazon Linux AMI: ALAS-2018-996: Security patch for stunnel, amazon-efs-utils
Description
This update adds the checkHost option to stunnel, which verifies the host of the peer certificate subject. Certificates are accepted if no checkHost option was specified, or the host name of the peer certificate matches any of the hosts specified with checkHost.
This update adds the OCSPaia option to stunnel, which enables stunnel to validate certificates with the list of OCSP responder URLs retrieved from their AIA (Authority Information Access) extension.
This update adds the verify option to stunnel, which verifies the peer certificate. The different verification levels are as follows: level 0 - request and ignore the peer certificate level 1 - verify the peer certificate if present level 2 - verify the peer certificate level 3 - verify the peer against a locally installed certificate level 4 - ignore the chain and only verify the peer certificate default - no verify
Certificates for verification needs to be stored either in the file specified with CAfile, or in the directory specified with CApath.
This update enables amazon-efs-utils to use new features added to stunnel to encrypt data in transit to EFS
Solution(s)
- amazon-linux-upgrade--amazon-efs-utils
- amazon-linux-upgrade-stunnel
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center