OpenSSL 3.0 November Security Release

[mthalman]

OpenSSL 3.0 November Security Release

.NET container images will be updated to incorporate upstream security patches for OpenSSL 3.0.

Details

An announcement from OpenSSL states that a fix for a critical severity vulnerability will be released on November 1, 2022 between 1300-1700 UTC.

Affected .NET container images include all Ubuntu 22.04 (Jammy) images. No other .NET container images are affected because they use OpenSSL 1.1.

For Ubuntu 22.04, OpenSSL 3.0 comes from the base Ubuntu image. It is not yet known when Ubuntu will have their base images updated. Updates to the derived .NET images will occur when the base Ubuntu image is updated to contain the patched version of OpenSSL. Once our images are updated you will need to pull the updated .NET container image and redeploy.

An update will posted to this announcement once the patched .NET images are available.

UPDATE: The .NET images are now patched.

[mthalman]

This update is now complete. All .NET images containing OpenSSL 3.0 have been updated to have the latest patched version (3.0.7). This affects all .NET images that contain "jammy" in the tag name.

[kjkc-gar]

I'm still seeing OpenSSL 3.0.2 on the latest 6.0-jammy-amd64 image with a digest of sha256:6d2bf1bbc4c2199bfb6e75418e7dd98326ff2ab7c134023612d71c8d09ae9a56. Is that expected?

[mthalman]

The package version should be listed as 3.0.2-0ubuntu1.7, which is the patched version. See the change log for that version: http://changelogs.ubuntu.com/changelogs/pool/main/o/openssl/openssl_3.0.2-0ubuntu1.7/changelog.

[kjkc-gar]

Thanks for the clarification!

[gitfool]

❯ docker pull ubuntu:jammy
jammy: Pulling from library/ubuntu
e96e057aae67: Pull complete
Digest: sha256:4b1d0c4a2d2aaf63b37111f34eb9fa89fa1bf53dd6e4ca954d47caebca4005c2
Status: Downloaded newer image for ubuntu:jammy
docker.io/library/ubuntu:jammy

❯ docker run --rm -it ubuntu:jammy

root@55e1ed9c4599:/# dpkg -l | grep libssl
ii  libssl3:amd64           3.0.2-0ubuntu1.7                        amd64        Secure Sockets Layer toolkit - shared libraries