I'm running Elastic Beanstalk with Tomcat 8.5 on the latest EB platform version (3.3.9 as of this writing). There is a security vulnerability in the version of OpenSSL that comes pre-installed in the EC2 image:
[ec2-user@ip-1-2-3-4 ~]$ openssl version
OpenSSL 1.0.2k-fips 26 Jan 2017
CVE 2019-1559
OpenSSL 1.0.2 prior to 1.0.2r is vulnerable to a 0-byte record padding oracle attack which could allow a remote attacker to decrypt data passing over the network.
There are no newer openssl versions when searching with yum, so how am I supposed to mitigate this threat? I also don't want to install an openssl version that may be incompatible with the services running (apache, tomcat, etc.).