We have a service running as a container for which there some reported vulnerabilities in OpenSSL. Our service is behind the Application Load Balancer, which ideally should terminate the traffic at the load balancer before decrypting the traffic and sending the request to the appropriate target group. But we are unsure if this is exploitable. The OpenSSL vulnerabilities in question are CVE-2023-2975 and CVE-2023-3817.
2 Answers
If the load balancer terminates TLS (like in Layer 7 load balancing) then this will mitigate these bugs in your application since there will be (depending on the configuration) no TLS spoken between the load balancer and your application or a new TLS connection created which does not inherit properties from the one to the load balancer.
But if the load balancer works only at Layer 4 (TCP) and does not terminate TLS, then it will simply pass through the original TCP connection from the client and thus will not mitigate the problems.
answered Sep 13 at 7:05
Specifically, AWS Application Load Balancer does run at the level of Layer 7 (HTTP/HTTPS).
Application Load Balancer operates at the request level (layer 7), routing traffic to targets (EC2 instances, containers, IP addresses, and Lambda functions) based on the content of the request. AWS Sell Sheet
Also, the two cited CVE are pretty minor. Neither are certainly used by your web server. One is a potential DoS, and the other is kind of vague but is described as:
Due to the low severity of this issue we are not issuing new releases of OpenSSL at this time. The fix will be included in the next releases when they become available. Openwall advisory
