GHSA-3wxx-jxwc-mg39 bottlerocket dependency openssl has a double free vulnerability

Not scored Published 9 Feb 2023

A double-free vulnerability in OpenSSL allows attackers to cause a denial of service by providing a malicious PEM file to applications using the library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-3wxx-jxwc-mg39?

GHSA-3wxx-jxwc-mg39 is an use after free vulnerability in bottlerocket/update-operator, published on 9 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A double-free vulnerability exists in OpenSSL where it is possible to construct a malicious PEM file that has 0 bytes of payload data. This then points to data that has already been freed in memory which, when freed again, leads to a crash. Agents or clients compiled with OpenSSL may crash unexpectedly when parsing these PEM files. OpenSSL has been removed in bottlerocket/update-operator version 1.1.0 in favor of Rust-based TLS using rustls.

Which versions are affected by GHSA-3wxx-jxwc-mg39?

1 open source package ship an affected version, including bottlerocket/update-operator.

Package	Affected	Fixed in
`bottlerocket/update-operator` crates.io	All versions	`1.1.0`

How do I fix GHSA-3wxx-jxwc-mg39?

Upgrade bottlerocket/update-operator to 1.1.0 or later.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is GHSA-3wxx-jxwc-mg39 being exploited?

There is no known exploitation of GHSA-3wxx-jxwc-mg39 in the wild and no public exploit code.

GHSA-3wxx-jxwc-mg39 bottlerocket dependency openssl has a double free vulnerability

What is GHSA-3wxx-jxwc-mg39?

Which versions are affected by GHSA-3wxx-jxwc-mg39?

How do I fix GHSA-3wxx-jxwc-mg39?

Is GHSA-3wxx-jxwc-mg39 being exploited?

Sources

Is GHSA-3wxx-jxwc-mg39 in your software?