ALAS2OPENSSL-SNAPSAFE-2026-009

Amazon Linux 2 Security Advisory: ALAS2OPENSSL-SNAPSAFE-2026-009
Advisory Released Date: 2026-02-19
Advisory Updated Date: 2026-02-19
Severity: Important
Issue Overview:

Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. (CVE-2025-68160)

A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. (CVE-2025-69420)

Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. (CVE-2025-69421)

ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function

NOTE: https://openssl-library.org/news/secadv/20260127.txt (CVE-2026-22796)


Affected Packages:

openssl-snapsafe


Note:

This advisory is applicable to Amazon Linux 2 - Openssl-snapsafe Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update openssl-snapsafe or yum update --advisory ALAS2OPENSSL-SNAPSAFE-2026-009 to update your system.

New Packages:
aarch64:
    openssl-snapsafe-1.0.2k-24.amzn2.0.19.aarch64
    openssl-snapsafe-libs-1.0.2k-24.amzn2.0.19.aarch64
    openssl-snapsafe-devel-1.0.2k-24.amzn2.0.19.aarch64
    openssl-snapsafe-static-1.0.2k-24.amzn2.0.19.aarch64
    openssl-snapsafe-perl-1.0.2k-24.amzn2.0.19.aarch64
    openssl-snapsafe-debuginfo-1.0.2k-24.amzn2.0.19.aarch64

i686:
    openssl-snapsafe-1.0.2k-24.amzn2.0.19.i686
    openssl-snapsafe-libs-1.0.2k-24.amzn2.0.19.i686
    openssl-snapsafe-devel-1.0.2k-24.amzn2.0.19.i686
    openssl-snapsafe-static-1.0.2k-24.amzn2.0.19.i686
    openssl-snapsafe-perl-1.0.2k-24.amzn2.0.19.i686
    openssl-snapsafe-debuginfo-1.0.2k-24.amzn2.0.19.i686

src:
    openssl-snapsafe-1.0.2k-24.amzn2.0.19.src

x86_64:
    openssl-snapsafe-1.0.2k-24.amzn2.0.19.x86_64
    openssl-snapsafe-libs-1.0.2k-24.amzn2.0.19.x86_64
    openssl-snapsafe-devel-1.0.2k-24.amzn2.0.19.x86_64
    openssl-snapsafe-static-1.0.2k-24.amzn2.0.19.x86_64
    openssl-snapsafe-perl-1.0.2k-24.amzn2.0.19.x86_64
    openssl-snapsafe-debuginfo-1.0.2k-24.amzn2.0.19.x86_64

Additional References

Release Notes:  Amazon Linux 2 Release Notes

Red Hat: CVE-2025-68160, CVE-2025-69420, CVE-2025-69421, CVE-2026-22796

Mitre: CVE-2025-68160, CVE-2025-69420, CVE-2025-69421, CVE-2026-22796