AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

AWSGHSA-q4mv-c662-pgwg

Allocated memory not freed when session ticket is used

AWS

Published Dec 14, 2020

Low
Fix: upgrade to v0.10.23 or later
GitHub advisory

s2n fails to free allocated memory when the session ticket decryption method fails. This could cause the host to run out of memory and force the application to restart.

Customers of AWS services do not need to take action. s2n users who are using session resumption in their applications should update to the most recent s2n version.

All versions of s2n from commit https://github.com/awslabs/s2n/commit/cc339f5315c04169445cf0d395ab0acc914f9827 to https://github.com/awslabs/s2n/commit/360f62054148ab8fcec78842d2632a9421554def are affected by this issue. s2n users should fetch s2n commit https://github.com/awslabs/s2n/commit/c422355bd15c3cade2a15d1574144b1b6a87cb2c

Affected versions

PackageAffectedFixed in
s2n
Product
< v0.10.23v0.10.23
Details and references

More AWS advisories

All AWS