PT-2023-33036 · Openssl · Openssl

Published 2023-02-09 · Updated 2023-02-09

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description A malicious third party can use a BIO in an OpenSSL public API to access unfreed memory pointers, which are not cleaned up after API execution. This can cause a crash when these memory pointers are freed. Agents and clients compiled with OpenSSL may experience unexpected crashes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-J79X-VVGM-W73W

Affected Products

Openssl

References · 6

• https://osv.dev/vulnerability/GHSA-j79x-vvgm-w73w · Vendor Advisory
• https://github.com/bottlerocket-os/bottlerocket-update-operator/releases/tag/v1.1.0 · Note
• https://github.com/bottlerocket-os/bottlerocket-update-operator/security/advisories/GHSA-j79x-vvgm-w73w · Note
• https://github.com/bottlerocket-os/bottlerocket-update-operator · Note
• https://openssl.org/news/secadv/20230207.txt · Note
• https://rustsec.org/advisories/RUSTSEC-2023-0009.html · Note