Publish GHSA-rp9h-rf7g-hwgr

2026-05-22 18:04:22 -07:00 · 2024-11-14 15:47:29 +00:00
parent 9fe90f06c3
commit 52c92a8746
1 changed files with 62 additions and 0 deletions
@@ -0,0 +1,62 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-rp9h-rf7g-hwgr",
+  "modified": "2024-11-14T15:45:55Z",
+  "published": "2024-11-14T15:45:55Z",
+  "aliases": [
+
+  ],
+  "summary": "s2n-tls has undefined behavior at process exit",
+  "details": "### Impact\ns2n-tls uses the Linux atexit function to register functions that clean up the global state when the process exits. In multi-threaded environments, the atexit handler may clean up state which is still in use by other threads. When this occurs, the exiting process may experience a segmentation fault or other undefined behavior. \n\nCustomers of AWS services do not need to take action. Applications using s2n-tls should upgrade to the most recent release of s2n-tls.\n\n**Impacted versions**: < v1.5.9.\n\n### Patches\nThe patch commit [493b771](https://github.com/aws/s2n-tls/commit/493b77167dc367c394de23cfe78a029298e2a254) is included in s2n-tls v1.5.9 [1]\n\n### Workarounds\nThe atexit handler may be disabled by calling `s2n_disable_atexit()` prior to initializing s2n-tls. The atexit handler is off by default in the patched versions. For further details, refer to [s2n-tls Usage Guide: Initialization and Teardown](https://github.com/aws/s2n-tls/blob/main/docs/usage-guide/topics/ch02-initialization.md).\n\nIf you have any questions or comments about this advisory, we ask that you contact AWS/Amazon Security via our vulnerability reporting page [2] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n\n[1] https://github.com/aws/s2n-tls/releases/tag/v1.5.9\n[2] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting\n",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "s2n-tls"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.3.7"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/aws/s2n-tls/security/advisories/GHSA-rp9h-rf7g-hwgr"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/aws/s2n-tls/commit/493b77167dc367c394de23cfe78a029298e2a254"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/aws/s2n-tls"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/aws/s2n-tls/releases/tag/v1.5.9"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-11-14T15:45:55Z",
+    "nvd_published_at": null
+  }
+}