MEDIUM

GHSA-j79x-vvgm-w73w

bottlerocket dependency openssl provides streaming of ASN.1 data via a BIO

Details

An OpenSSL public API provides streaming of ASN.1 data via a BIO. It is possible for a malicious third party to use the BIO to access unfreed memory pointers that are not cleaned up after execution of the API. Freeing these memory pointers will result in a crash. Agents and clients compiled with OpenSSL may see unexpected crashes. OpenSSL has been removed in bottlerocket/update-operator version 1.1.0 in favor of Rust-based TLS using rustls.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/bottlerocket/update-operator

Introduced in: 0Fixed in: 1.1.0

Upgrade bottlerocket/update-operator to 1.1.0 or newer (ecosystem crates.io).

References

https://github.com/bottlerocket-os/bottlerocket-update-operator/security/advisories/GHSA-j79x-vvgm-w73w[WEB]
https://github.com/bottlerocket-os/bottlerocket-update-operator[PACKAGE]
https://github.com/bottlerocket-os/bottlerocket-update-operator/releases/tag/v1.1.0[WEB]
https://rustsec.org/advisories/RUSTSEC-2023-0009.html[WEB]
https://www.openssl.org/news/secadv/20230207.txt[WEB]