GHSA-qf87-q4gg-cg43
bottlerocket dependency openssl is vulnerable to dereferenced null pointers
A null pointer in OpenSSL can be dereferenced when signatures are being verified in malformed PKCS7 data. Agents or clients compiled with OpenSSL may experience unexpected crashes. OpenSSL has been removed in bottlerocket/update-operator version 1.1.0 in favor of Rust-based TLS using rustls.
What each source reports
OSVNo score
bottlerocket dependency openssl is vulnerable to dereferenced null pointers
A null pointer in OpenSSL can be dereferenced when signatures are being verified in malformed PKCS7 data. Agents or clients compiled with OpenSSL may experience unexpected crashes. OpenSSL has been removed in bottlerocket/update-operator version 1.1.0 in favor of Rust-based TLS using rustls.
- Record
GHSA-qf87-q4gg-cg43- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bottlerocket/update-operatorcrates.io | before 1.1.0 | 1.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-qf87-q4gg-cg43 is a vulnerability with no CVSS score yet in bottlerocket/update-operator, published February 9, 2023. No source lists public exploit code. Fixed in bottlerocket/update-operator 1.1.0.