Repository navigation
Update OpenSSL used in binary releases per CVE-2023-0464 #103142
Description
Activity
We are still waiting on the upstream OpenSSL release as of today.
https://www.openssl.org/ considers these low severity, so deferring this to not block releases could make sense. Otherwise we'd need to cherry pick a few patches and apply them as part of our build or pull a pre-release tarball from their source control, both of which sound annoying.
From https://www.openssl.org/source/ it appears there's no 1.1.1u release yet. Is this still a blocker?
wait until the day our releases are being built and bump it back to deferred if upstream openssl hasn't done releases.
Reacted by Jelle ZijlstraFYI: Their next release is planned to be in May.
17 remaining items
Everything back through 3.11 has been updated to build binary releases using OpenSSL 1.1.1u.
Backports for 3.10 and 3.9 exist as PRs for their respective @pablogsal and @ambv release managers to merge.
For 3.8 and 3.7 branches, I recommend doing a backport from the 3.9 commit once that PR is merged (if the RMs choose to merge it; we don't build binary releases for versions that old so that's up to them - it's at least useful for other vendors who potentially do?)
Reacted by h-vetinari- added 4 commits that reference this issue
on Jun 5, 2023 This has now been backported to 3.8 and 3.7 as well. For 3.7, there is only a partial backport because some of the changes in earlier releases to fully support OpenSSL 3.x were not backported to 3.7.
- moved this from Todo to Done in Release and Deferred blockers 🚫
on Jun 6, 2023
https://nvd.nist.gov/vuln/detail/CVE-2023-0464
We need OpenSSL >= 1.1.1u | 3.0.9 | 3.1.1.
We've got patch releases coming up soon, we should be able to just bump the versions before then.
(note: at the time of this writing OpenSSL hasn't even released those updated versions)
Linked PRs