Inappropriate coding practices In bottlerocket/update-operator
Description
bottlerocket dependency openssl has a double free vulnerability A double-free vulnerability exists in OpenSSL where it is possible to construct a malicious PEM file that has 0 bytes of payload data. This then points to data that has already been freed in memory which, when freed again, leads to a crash. Agents or clients compiled with OpenSSL may crash unexpectedly when parsing these PEM files. OpenSSL has been removed in bottlerocket/update-operator version 1.1.0 in favor of Rust-based TLS using rustls.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 cargo | 1.1.0 |
Aliases
1. 2. 3.
References
1. 2. 3. 4.