openssl: CVE-2015-3193, CVE-2015-3194, CVE-2015-3195, CVE-2015-3196

[tianon]

CVE-2015-3193, CVE-2015-3194, CVE-2015-3195, CVE-2015-3196, CVE-2015-1794

https://mta.openssl.org/pipermail/openssl-announce/2015-December/000050.html
https://mta.openssl.org/pipermail/openssl-announce/2015-December/000055.html

• alpine: Bump Alpine for CVE-2015-3193, CVE-2015-3194, CVE-2015-3195 #1255 -- libssl1.0-1.0.2d-r0
  • http://bugs.alpinelinux.org/issues/4921
  • http://git.alpinelinux.org/cgit/aports/log/main/openssl
  • http://bugs.alpinelinux.org/projects/alpine/search?q=CVE-2015-3193
  • http://bugs.alpinelinux.org/projects/alpine/search?q=CVE-2015-3194
  • http://bugs.alpinelinux.org/projects/alpine/search?q=CVE-2015-3195
  • http://bugs.alpinelinux.org/projects/alpine/search?q=CVE-2015-3196
  • http://bugs.alpinelinux.org/projects/alpine/search?q=CVE-2015-1794
• busybox: not affected
• centos (RHEL derivative): bump latest centos 7 images, add 7.2 #1275 -- openssl-libs-1.0.1e-42.el7.9.x86_64
  • https://access.redhat.com/security/cve/CVE-2015-3193
  • https://access.redhat.com/security/cve/CVE-2015-3194
  • https://access.redhat.com/security/cve/CVE-2015-3195
  • https://access.redhat.com/security/cve/CVE-2015-3196
  • https://access.redhat.com/security/cve/CVE-2015-1794
• crux: OpenSSL 1.0.2d -- update available
  • https://crux.nu/gitweb/?p=ports/core.git;a=history;f=openssl;hb=HEAD
• debian: Update debian, especially for OpenSSL CVEs #1241 -- no SSL in the base image, but many descendants
  • https://security-tracker.debian.org/tracker/CVE-2015-3193
  • https://security-tracker.debian.org/tracker/CVE-2015-3194
  • https://security-tracker.debian.org/tracker/CVE-2015-3195
  • https://security-tracker.debian.org/tracker/CVE-2015-3196
  • https://security-tracker.debian.org/tracker/CVE-2015-1794
• fedora: update for openssl CVEs #1316 -- openssl-libs-1.0.2d-3.fc23.x86_64
  • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-3193
  • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-3194
  • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-3195
  • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-3196
  • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-1794
• mageia: Updated images for CVE-2015-319[3-5] and CVE-2015-1794 #1254 -- lib64openssl1.0.0-1.0.2d-1.mga5
  • https://bugs.mageia.org/show_bug.cgi?id=17292
  • https://bugs.mageia.org/buglist.cgi?quicksearch=ALL%20CVE-2015-3193
  • https://bugs.mageia.org/buglist.cgi?quicksearch=ALL%20CVE-2015-3194
  • https://bugs.mageia.org/buglist.cgi?quicksearch=ALL%20CVE-2015-3195
  • https://bugs.mageia.org/buglist.cgi?quicksearch=ALL%20CVE-2015-3196
  • https://bugs.mageia.org/buglist.cgi?quicksearch=ALL%20CVE-2015-1794
• opensuse: Update openSUSE images to fix security issues #1257 -- openssl-1.0.1i-4.1.x86_64/libopenssl1_0_0-1.0.1i-4.1.x86_64
  • https://bugzilla.novell.com/show_bug.cgi?id=CVE-2015-3193
  • https://bugzilla.novell.com/show_bug.cgi?id=CVE-2015-3194
  • https://bugzilla.novell.com/show_bug.cgi?id=CVE-2015-3195
  • https://bugzilla.novell.com/show_bug.cgi?id=CVE-2015-3196
  • https://bugzilla.novell.com/show_bug.cgi?id=CVE-2015-1794
• oraclelinux: Updated Oracle Linux 7.2 image #1287 -- openssl-libs-1.0.1e-42.el7_1.9.x86_64
  • http://linux.oracle.com/cve/CVE-2015-3193.html
  • http://linux.oracle.com/cve/CVE-2015-3194.html
  • http://linux.oracle.com/cve/CVE-2015-3195.html
  • http://linux.oracle.com/cve/CVE-2015-3196.html
  • http://linux.oracle.com/cve/CVE-2015-1794.html
• sourcemage: OpenSSL 0.9.8zd -- update available
  • http://www.sourcemage.org/projects/grimoire/repository/changes/crypto/openssl?rev=master
  • http://www.sourcemage.org/projects/grimoire/search?scope=all&q=CVE-2015-3193
  • http://www.sourcemage.org/projects/grimoire/search?scope=all&q=CVE-2015-3194
  • http://www.sourcemage.org/projects/grimoire/search?scope=all&q=CVE-2015-3195
  • http://www.sourcemage.org/projects/grimoire/search?scope=all&q=CVE-2015-3196
  • http://www.sourcemage.org/projects/grimoire/search?scope=all&q=CVE-2015-1794
• ubuntu: Update ubuntu (especially for CVE-2015-3193 and friends) #1251 -- libssl1.0.0_1.0.1f-1ubuntu2.15
  • http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-3193.html
  • http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-3194.html
  • http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-3195.html
  • http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-3196.html
  • http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1794.html

[tianon]

@andyshinn http://bugs.alpinelinux.org/issues/4921 looks like it's been updated there; can we get an updated alpine image with newer openssl? 👍

[tianon]

@maxamillion openssl-1.0.2e-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report. seems promising -- fedora image update forthcoming? 😄

[tianon]

@flavio it looks like there's been some good activity on those CVE bugs for opensuse, but I'm not sure whether what's there means updated/fixed packages are available yet or not; can you help interpret and take the torch from here?

[tianon]

@prologic looks like crux has an updated openssl/Pkgfile now (https://crux.nu/gitweb/?p=ports/core.git;a=commit;h=cebb07c1929502695985eafe10b9299f6a2f1179); can we get an updated image? 😄

[prologic]

@tianon Yes of course; in a few days :) (hopefully this weekend).

[tianon]

@prologic 🤘 thanks!

[tianon]

@vaygr looks like sourcemage hasn't been updated yet (http://www.sourcemage.org/projects/grimoire/repository/changes/crypto/openssl?rev=master); am I looking in the right places for this kind of information?

[tianon]

@juanluisbaptiste mageia update appears to be available now! (https://bugs.mageia.org/show_bug.cgi?id=17292) can we get an updated image? 😄

[juanluisbaptiste]

Done, PR: #1254

I'm sorry for the delay !

[tianon]

@Djelibeybi looks like Oracle's updated now also -- can we get some fresh images? 🙏 😄

[Djelibeybi]

I've asked our build team to trigger a rebuild. We will only update oraclelinux:latest, though.

[Djelibeybi]

Question for @tianon and others: what makes you trigger one of these CVE rebuilds? The CVEs are moderate/low and usually we wouldn't rebuild unless they were High/Critical. I'm just trying to work out what level to set our automation at, because we wouldn't have considered a rebuild/republish for these CVEs.

[tianon]

We have a very low threshold for what we consider important enough to rebuild the base for because the officially recommended way you fix your own images in light of a vulnerability is to update the base and rebuild your image from a Dockerfile; if the base doesn't get updated, the Dockerfile re-build will be cached (and if the package that needs to be updated is included in the base image, it wouldn't get updated even if the build wasn't cached). We do try to use the CVSS / determined Docker-use-case impact to determine how actively we should start harassing upstreams, but I try to be reasonable and not harass you guys until your relevant distribution actually does have updated packages available.

[Djelibeybi]

@tianon fixed in PR #1287.

Also, if you open this sort of issue in future, please ping me earlier. I don't monitor the entire repo. :)

[vaygr]

@tianon thanks for the notice, the better place is plain git web-interface here: http://scmweb.sourcemage.org/. We will generate new image shortly and create a new PR for it.

[tianon]

@Djelibeybi will do, thanks!

@vaygr ahhh nice, yeah that looks much better 👍 Thanks! 😄

[tianon]

I think it's probably about time we declared this one "as fixed as it's going to be", and I'm thus going to close this tracking issue. Thanks folks!

For any maintainers still straggling here, you should definitely focus your efforts on #1448 ASAP and consider this openssl update to be a side benefit to fixing that one. 👍