[MESOS-10041] Libprocess SSL verification can leak memory

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.9.0
• Fix Version/s: 1.9.1, 1.10.0
• Component/s: libprocess
• Labels: libprocess ssl
• Story Points: 1
• Assignee: Benno Evers
• Reporter: Greg Mann
• Created: 22/Nov/19 20:22
• Updated: 23/Nov/19 00:15
• Resolved: 23/Nov/19 00:15

Description

In process::network::openssl::verify(), when the SSL hostname validation scheme is set to "openssl", the function can return without freeing an X509 object, leading to a memory leak.