Every CVESearch/Get API key

GHSA-j859-pmrq-9q6c

bottlerocket dependency openssl has a double free vulnerability

No scoreFix available

GHSA-j859-pmrq-9q6c is a vulnerability with no CVSS score yet in bottlerocket/update-operator, published February 9, 2023. No source lists public exploit code. Fixed in bottlerocket/update-operator 1.1.0.

What does this mean?
Severity
UnratedNo CVSS score yet
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1.1.0bottlerocket/update-operator

Description

A timing based side channel exists in the OpenSSL RSA decryption implementation which could enable a recovery of plaintext from across the network. This affects all RSA padding modes. A server agent compiled with OpenSSL could be made to give up plaintext payloads over the network, but this would require a large amount of malicious payloads from a third party actor as trial messages. OpenSSL removed in bottlerocket version 1.1.0 in favor of Rust-based TLS using rustls.

Affected packages

Affected packages
PackageAffectedFixed
bottlerocket/update-operator
crates.io
before 1.1.0
1.1.0

What each source reports

OSVNo score

bottlerocket dependency openssl has a double free vulnerability

A timing based side channel exists in the OpenSSL RSA decryption implementation which could enable a recovery of plaintext from across the network. This affects all RSA padding modes. A server agent compiled with OpenSSL could be made to give up plaintext payloads over the network, but this would require a large amount of malicious payloads from a third party actor as trial messages. OpenSSL removed in bottlerocket version 1.1.0 in favor of Rust-based TLS using rustls.

Record
GHSA-j859-pmrq-9q6c
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedOSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open