GHSA-pj34-fpw3-83qj
Suggest an improvement- Source
- https://github.com/advisories/GHSA-pj34-fpw3-83qj
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-pj34-fpw3-83qj/GHSA-pj34-fpw3-83qj.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-pj34-fpw3-83qj
- Published
- 2023-02-09T19:31:25Z
- Modified
- 2023-02-09T19:31:25Z
- Summary
- bottlerocket dependency openssl is vulnerable to read buffer overflow via X.509 verification
- Details
-
A read buffer overflow can be triggered in OpenSSL X.509 verification during name constraint checking. Note that this occurs after the certificate chain has been verified and would require a compromised CA. This can cause a client or agent compiled with OpenSSL to crash unexpectedly. OpenSSL has been removed in bottlerocket/update-operator version 1.1.0 in favor of Rust-based TLS using rustls.
- References
-
- https://github.com/bottlerocket-os/bottlerocket-update-operator/security/advisories/GHSA-pj34-fpw3-83qj
- https://github.com/bottlerocket-os/bottlerocket-update-operator
- https://github.com/bottlerocket-os/bottlerocket-update-operator/releases/tag/v1.1.0
- https://www.openssl.org/news/secadv/20230207.txt
Affected packages
crates.io / bottlerocket/update-operator
Package
- Name
- bottlerocket/update-operator
- View open source insights on deps.dev
- Purl
- pkg:cargo/bottlerocket/update-operator