AWSGHSA-q4mv-c662-pgwg
Allocated memory not freed when session ticket is used
Fix: upgrade to v0.10.23 or later
s2n fails to free allocated memory when the session ticket decryption method fails. This could cause the host to run out of memory and force the application to restart.
Customers of AWS services do not need to take action. s2n users who are using session resumption in their applications should update to the most recent s2n version.
All versions of s2n from commit https://github.com/awslabs/s2n/commit/cc339f5315c04169445cf0d395ab0acc914f9827 to https://github.com/awslabs/s2n/commit/360f62054148ab8fcec78842d2632a9421554def are affected by this issue. s2n users should fetch s2n commit https://github.com/awslabs/s2n/commit/c422355bd15c3cade2a15d1574144b1b6a87cb2c
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| s2n Product | < v0.10.23 | v0.10.23 |
Details and references
- Severity from
- GitHub (reviewed advisory)