MEDIUM

GHSA-pj34-fpw3-83qj

bottlerocket dependency openssl is vulnerable to read buffer overflow via X.509 verification

Details

A read buffer overflow can be triggered in OpenSSL X.509 verification during name constraint checking. Note that this occurs after the certificate chain has been verified and would require a compromised CA. This can cause a client or agent compiled with OpenSSL to crash unexpectedly. OpenSSL has been removed in bottlerocket/update-operator version 1.1.0 in favor of Rust-based TLS using rustls.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/bottlerocket/update-operator

Introduced in: 0Fixed in: 1.1.0

Upgrade bottlerocket/update-operator to 1.1.0 or newer (ecosystem crates.io).

References

https://github.com/bottlerocket-os/bottlerocket-update-operator/security/advisories/GHSA-pj34-fpw3-83qj[WEB]
https://github.com/bottlerocket-os/bottlerocket-update-operator[PACKAGE]
https://github.com/bottlerocket-os/bottlerocket-update-operator/releases/tag/v1.1.0[WEB]
https://www.openssl.org/news/secadv/20230207.txt[WEB]