{"id":"GHSA-j79x-vvgm-w73w","summary":"bottlerocket dependency openssl provides streaming of ASN.1 data via a BIO","details":"An OpenSSL public API provides streaming of ASN.1 data via a BIO. It is possible for a malicious third party to use the BIO to access unfreed memory pointers that are not cleaned up after execution of the API. Freeing these memory pointers will result in a crash. Agents and clients compiled with OpenSSL may see unexpected crashes. OpenSSL has been removed in bottlerocket/update-operator version 1.1.0 in favor of Rust-based TLS using rustls.","modified":"2023-02-09T18:08:51Z","published":"2023-02-09T18:08:51Z","database_specific":{"github_reviewed_at":"2023-02-09T18:08:51Z","github_reviewed":true,"nvd_published_at":null,"severity":"MODERATE","cwe_ids":[]},"references":[{"type":"WEB","url":"https://github.com/bottlerocket-os/bottlerocket-update-operator/security/advisories/GHSA-j79x-vvgm-w73w"},{"type":"PACKAGE","url":"https://github.com/bottlerocket-os/bottlerocket-update-operator"},{"type":"WEB","url":"https://github.com/bottlerocket-os/bottlerocket-update-operator/releases/tag/v1.1.0"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2023-0009.html"},{"type":"WEB","url":"https://www.openssl.org/news/secadv/20230207.txt"}],"affected":[{"package":{"name":"bottlerocket/update-operator","ecosystem":"crates.io","purl":"pkg:cargo/bottlerocket/update-operator"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-j79x-vvgm-w73w/GHSA-j79x-vvgm-w73w.json"}}],"schema_version":"1.7.3"}