An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS0zd3h4LWp4d2MtbWczOc4AAxgh

bottlerocket dependency openssl has a double free vulnerability

A double-free vulnerability exists in OpenSSL where it is possible to construct a malicious PEM file that has 0 bytes of payload data. This then points to data that has already been freed in memory which, when freed again, leads to a crash. Agents or clients compiled with OpenSSL may crash unexpectedly when parsing these PEM files. OpenSSL has been removed in bottlerocket/update-operator version 1.1.0 in favor of Rust-based TLS using rustls.

Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: about 1 month ago

Identifiers: GHSA-3wxx-jxwc-mg39
References: Repository:
Blast Radius: 1.0

Affected Packages

Affected Version Ranges: < 1.1.0
Fixed in: 1.1.0