{"id":"GHSA-j79x-vvgm-w73w","aliases":[],"status":"published","title":"bottlerocket dependency openssl provides streaming of ASN.1 data via a BIO","description":"An OpenSSL public API provides streaming of ASN.1 data via a BIO. It is possible for a malicious third party to use the BIO to access unfreed memory pointers that are not cleaned up after execution of the API. Freeing these memory pointers will result in a crash. Agents and clients compiled with OpenSSL may see unexpected crashes. OpenSSL has been removed in bottlerocket/update-operator version 1.1.0 in favor of Rust-based TLS using rustls.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-02-09T18:08:51Z","modified":"2023-02-09T18:08:51Z","fixes":[{"ecosystem":"crates.io","package":"bottlerocket/update-operator","fixed_in":["1.1.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"bottlerocket/update-operator","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}]}],"references":[{"url":"https://github.com/bottlerocket-os/bottlerocket-update-operator/security/advisories/GHSA-j79x-vvgm-w73w","tags":["web"]},{"url":"https://github.com/bottlerocket-os/bottlerocket-update-operator","tags":["package"]},{"url":"https://github.com/bottlerocket-os/bottlerocket-update-operator/releases/tag/v1.1.0","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0009.html","tags":["web"]},{"url":"https://www.openssl.org/news/secadv/20230207.txt","tags":["web"]}],"sources":{"osv":[{"id":"GHSA-j79x-vvgm-w73w","title":"bottlerocket dependency openssl provides streaming of ASN.1 data via a BIO","description":"An OpenSSL public API provides streaming of ASN.1 data via a BIO. It is possible for a malicious third party to use the BIO to access unfreed memory pointers that are not cleaned up after execution of the API. Freeing these memory pointers will result in a crash. Agents and clients compiled with OpenSSL may see unexpected crashes. OpenSSL has been removed in bottlerocket/update-operator version 1.1.0 in favor of Rust-based TLS using rustls.","status":"published","published":"2023-02-09T18:08:51Z","modified":"2023-02-09T18:08:51Z","updated_at":"2026-11-02T15:46:49.977351Z"}]}}