ALAS covering this vulnerability:

https://alas.aws.amazon.com/ALAS-2015-473.html

As usual, the Elastic Beanstalk team (with their forked yum repositories) are lagging behind on a fix.