GHSA-j859-pmrq-9q6c
Suggest an improvement- Source
- https://github.com/advisories/GHSA-j859-pmrq-9q6c
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-j859-pmrq-9q6c/GHSA-j859-pmrq-9q6c.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-j859-pmrq-9q6c
- Published
- 2023-02-09T19:32:29Z
- Modified
- 2023-02-09T19:32:29Z
- Summary
- bottlerocket dependency openssl has a double free vulnerability
- Details
-
A timing based side channel exists in the OpenSSL RSA decryption implementation which could enable a recovery of plaintext from across the network. This affects all RSA padding modes. A server agent compiled with OpenSSL could be made to give up plaintext payloads over the network, but this would require a large amount of malicious payloads from a third party actor as trial messages. OpenSSL removed in bottlerocket version 1.1.0 in favor of Rust-based TLS using rustls.
- Database specific
{ "nvd_published_at": null, "github_reviewed_at": "2023-02-09T19:32:29Z", "severity": "MODERATE", "github_reviewed": true, "cwe_ids": [] }- References
-
- https://github.com/bottlerocket-os/bottlerocket-update-operator/security/advisories/GHSA-j859-pmrq-9q6c
- https://github.com/bottlerocket-os/bottlerocket-update-operator
- https://github.com/bottlerocket-os/bottlerocket-update-operator/releases/tag/v1.1.0
- https://rustsec.org/advisories/RUSTSEC-2023-0007.html
- https://www.openssl.org/news/secadv/20230207.txt
Affected packages
crates.io / bottlerocket/update-operator
Package
- Name
- bottlerocket/update-operator
- View open source insights on deps.dev
- Purl
- pkg:cargo/bottlerocket/update-operator