Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1qNzl4LXZ2Z20tdzczd84AAxgK

bottlerocket dependency openssl provides streaming of ASN.1 data via a BIO

An OpenSSL public API provides streaming of ASN.1 data via a BIO. It is possible for a malicious third party to use the BIO to access unfreed memory pointers that are not cleaned up after execution of the API. Freeing these memory pointers will result in a crash. Agents and clients compiled with OpenSSL may see unexpected crashes. OpenSSL has been removed in bottlerocket/update-operator version 1.1.0 in favor of Rust-based TLS using rustls.

Permalink: https://github.com/advisories/GHSA-j79x-vvgm-w73w
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qNzl4LXZ2Z20tdzczd84AAxgK
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: about 2 months ago

Identifiers: GHSA-j79x-vvgm-w73w
References:

• https://github.com/bottlerocket-os/bottlerocket-update-operator/security/advisories/GHSA-j79x-vvgm-w73w
• https://github.com/bottlerocket-os/bottlerocket-update-operator/releases/tag/v1.1.0
• https://rustsec.org/advisories/RUSTSEC-2023-0009.html
• https://www.openssl.org/news/secadv/20230207.txt
• https://github.com/advisories/GHSA-j79x-vvgm-w73w

Repository: https://github.com/bottlerocket-os/bottlerocket-update-operator
Blast Radius: 1.0

Affected Packages