Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #29271 Remediation for CVE-2022-3786 & CVE-2022-3602 (OpenSSL 3.0.0 to 3.0.6)
    Actions
    Infos
    #29271
    Thomas Gerbet (tgerbet)
    2022-11-07 16:53
    2022-11-02 11:26
    30865
    Details
    Remediation for CVE-2022-3786 & CVE-2022-3602 (OpenSSL 3.0.0 to 3.0.6)

    Context: on 2022-10-25 the OpenSSL team announced a security fix release for critical vulnerabilities. The severity level was, on the day of the release, downgraded to high.

    TL;DR: this issue does and did not have any significant impact on the Tuleap project infrastructure or Tuleap deliverables.

    Tuleap project infrastructure:

    • only gerrit.tuleap.net was affected by the issue. Following the advisory release (~ 2022-11-01 15h44 UTC) we came to the conclusion the vulnerabilities could not be exploited in our context (2022-11-01 16h06 UTC). Patches have been applied since then (2022-11-02 05h18 UTC).

    Tuleap deliverables:

    • OS packages are not impacted: Tuleap is deployed on CentOS / RHEL 7 where nothing depends on OpenSSL 3.
    • the Git version Tuleap uses via its tuleap-git-bin package links statically against OpenSSL 3.0.5 which is vulnerable. However, the code paths affected by it cannot be triggered within a normal usage of Tuleap (no communication overs HTTPS with a remote Git origin). As this does not present a significant threat we are waiting on nixpkgs binary cache to be up to date before upgrading.
    • we use a vulnerable OpenSSL when fetching sources for our "additional packages" but due to the nature of the vulnerabilities it cannot be really exploited: it would require that a trusted CA sign a malicious certificate and to achieve an RCE it also requires to bypass the stack protection mechanisms. Nonetheless, we will update as soon as the nixpkgs binary cache are up to date.
    Other
    Empty
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Thomas Gerbet (tgerbet)
    Closed
    2022-11-07
    Attachments
    Artifact links

    Releases

    Fixed in

    Artifact ID Project Tracker Summary Status Last Update Date Submitted By Assigned to
    rel #27178 Tuleap Releases 14.2 Delivered 2022-11-14 09:20 Manuel Vacelet (vaceletm)
    Empty
    References
    Referencing request #29271

    Git commit

    tuleap/tuleap/stable

    Use OpenSSL 3.0.7 to build the `tuleap-git-bin` package 7f54366506
    User avatar Thomas Gerbet (tgerbet) , 2022-11-07 12:10
    Display settings

    Follow-ups

    User avatar
    Thomas Gerbet (tgerbet)2022-11-07 12:20

    Since we are close to the release cut-off, I took the decision to build the tuleap-git-bin package (it is the only affected package in our deliverables) with OpenSSL 3.0.7 but keep the global pin as it is for now to limit the chances of breaking something. We will update it once Tuleap 14.2 is released.

    See gerrit #27165.

    • Status changed from Under implementation to Under review
    User avatar
    Thomas Gerbet (tgerbet)2022-11-02 12:06

    Additional notes:

    For everything we build via Nix determining if we had a vulnerable OpenSSL in our dependency graph was fairly easy since we can explore the dependency tree:

    1. Instantiate the store derivation
    $ nix-instantiate ./tools/rpm/rpm-additional-packages.nix
/nix/store/x2ak35clyn8al4mwvh3wpqb9v2k3fbd8-rpm-additional-packages.drv
    1. The next step is to determine if we have the vulnerable OpenSSL version somewhere in our dependencies and than ask why we depend on it. Note that we do static builds so we have to include our build dependencies and that nix why-depends will show the shortest paths by default so you might want to add a --all flag to get all the edges.
    $ nix-store --query -R /nix/store/myrsmzphjdfx6raviz35220pvy52qnpa-rpm-additional-packages.drv | grep openssl-3 | xargs -L 1 nix why-depends --derivation /nix/store/myrsmzphjdfx6raviz35220pvy52qnpa-rpm-additional-packages.drv
/nix/store/myrsmzphjdfx6raviz35220pvy52qnpa-rpm-additional-packages.drv
└───/nix/store/6idmsylcbkf0a6j8jg2xj3cdc2vq0d1r-tuleap-gitolite3-3.6.12.drv
    └───/nix/store/86gk8l23v1lwqjn1nza9zxrqnfsi0d71-v3.6.12.tar.gz.drv
        └───/nix/store/6yli10gh1bvifslgz7szr9y10xh22szz-curl-7.85.0.drv
            └───/nix/store/glbylradcskjsd24gxgs6br8bqrc6ll4-openssl-3.0.5.drv
                └───/nix/store/2zzzcckq8565aavnlkwc69gvn9dg5ki9-openssl-3.0.5.tar.gz.drv
/nix/store/myrsmzphjdfx6raviz35220pvy52qnpa-rpm-additional-packages.drv
└───/nix/store/6idmsylcbkf0a6j8jg2xj3cdc2vq0d1r-tuleap-gitolite3-3.6.12.drv
    └───/nix/store/86gk8l23v1lwqjn1nza9zxrqnfsi0d71-v3.6.12.tar.gz.drv
        └───/nix/store/6yli10gh1bvifslgz7szr9y10xh22szz-curl-7.85.0.drv
            └───/nix/store/glbylradcskjsd24gxgs6br8bqrc6ll4-openssl-3.0.5.drv
/nix/store/myrsmzphjdfx6raviz35220pvy52qnpa-rpm-additional-packages.drv
└───/nix/store/nzm0r0937hiv6dw09xd0l82pham972ci-tuleap-git-bin.drv
    └───/nix/store/wp27qrpav641zcxp9m19i4kqrfsxiyzj-git-minimal-static-x86_64-unknown-linux-musl-2.38.1.drv
        └───/nix/store/p22rmagcl6pra1ljjj9f20nkjhdca5i0-openssl-static-x86_64-unknown-linux-musl-3.0.5.drv
            └───/nix/store/cgcb1qh8ahys041r6d3l3hqgzrbny5vh-openssl-3.0.5.tar.gz.drv
/nix/store/myrsmzphjdfx6raviz35220pvy52qnpa-rpm-additional-packages.drv
└───/nix/store/1rl6i7balyn1y0k3a0ckj8y1caqy3dwd-mediawiki-math-tuleap.drv
    └───/nix/store/09r6sbixfyaimmikfky7vy4msydid95a-mediawiki-math-tuleap-b4a2dda.drv
        └───/nix/store/b6cs93byll6f909jc4pz2rka2jpr0yzi-git-minimal-2.37.3.drv
            └───/nix/store/i1fs6hz4jyxii02411nshjiqj4qf4n52-openssl-3.0.5.drv

    We also ship two binaries that bundle Node, they were not affected since we use Node 16 which does not use OpenSSL 3. However it is not a great situation: determining what get into those binaries is harder than for stuff we build through Nix and we would have had a hard time quickly patching them if needed.

    • Original Submission
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes