PT-2023-33053 · Openssl · Openssl
Published
2023-02-09
·
Updated
2023-02-09
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
OpenSSL versions prior to 1.1.0
Description
A null pointer in OpenSSL can be dereferenced when signatures are being verified in malformed PKCS7 data, potentially causing unexpected crashes in agents or clients compiled with OpenSSL.
Recommendations
For versions prior to 1.1.0, update to bottlerocket/update-operator version 1.1.0 or later, which replaces OpenSSL with Rust-based TLS using rustls.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openssl