OpenSSL CVEs Mar-19-2015

[Erica Windisch]

OpenSSL 1.0.0j 10 May 2012

vulnerable to several vulnerabilities fixed in 1.0.0r.

https://www.openssl.org/news/secadv_20150319.txt
https://isc.sans.edu/diary/OpenSSL+Patch+Released/19485

Not marked security as these are public vulnerabilities and not part of an active embargo.

[Dr. Jens Harbott (j-harbott)]

This can be solved by using a buildroot that is recent enough, currently not yet available as a stable release, see the updates that I pushed in https://code.launchpad.net/~j-rosenboom-j/cirros/update-ipv6.

[Dr. Jens Harbott (j-harbott)]

Looking at the buildroot config, it seems to me that we do not need openssl libraries at all. Probably they were added implicitly when compiling openssh, but not dropped again after moving to dropbear.

[Scott Moser (smoser)]

Aren't they used by curl ?

[Scott Moser (smoser)]

also, i think we're probably fix-committed in trunk now with update to buildroot.

[Scott Moser (smoser)]

marking as such, if you disagree please re-open.

[Erica Windisch (ewindisch)]

Love to get a fix-released with this. Screenshot of the Docker Hub reminding users that this image might be vulnerable. This list is truncated, there are a LOT of vulnerabilities in this OpenSSL release.

(Objectively, I recognize that shipped binaries may not actually be using this openssl lib, but it may also be assumed that users may be using dynamic binaries linked to openssl)