Project

General

Profile

Actions
Copy link

Bug #22532

closed

Update openssl crate to fix several vulnerabilities

Bug #22532: Update openssl crate to fix several vulnerabilities

Added by Alexis Mousset about 3 years ago. Updated over 2 years ago.

Status:
Released
Priority:
N/A
Assignee:
Vincent MEMBRÉ
Category:
Security
Target version:
old 6.2 issues to relocate
Pull Request:
https://github.com/Normation/rudder/p...
Severity:
UX impact:
User visibility:
Effort required:
Priority:
0
Name check:
To do
Fix check:
Checked
Regression:
No

Description

Updated by Alexis Mousset about 3 years ago Actions
Copy link
 #1

  • Status changed from New to In progress
  • Assignee set to Alexis Mousset

Updated by Alexis Mousset about 3 years ago Actions
Copy link
 #2

  • Status changed from In progress to Pending technical review
  • Assignee changed from Alexis Mousset to Vincent MEMBRÉ
  • Pull Request set to https://github.com/Normation/rudder/pull/4716

Updated by Alexis Mousset about 3 years ago Actions
Copy link
 #3

  • Status changed from Pending technical review to Pending release

Updated by Alexis Mousset about 3 years ago Actions
Copy link
 #4

In relayd we only use:

use openssl::{
    stack::Stack,
    x509::{store::X509StoreBuilder, X509},
    error::ErrorStack,
    pkey::{PKey, Public},
    rsa::Rsa,
    sign::Verifier,
    pkcs7::{Pkcs7, Pkcs7Flags},
    hash::MessageDigest,
};

So we're not directly affetected. We still need to check what is used in the HTTPS client.

Updated by Alexis Mousset about 3 years ago Actions
Copy link
 #5

The affected functions are not used in rust-native-tls either so we're very likely safe.

Updated by Vincent MEMBRÉ almost 3 years ago Actions
Copy link
 #6

  • Fix check changed from To do to Checked

Updated by Alexis Mousset over 2 years ago Actions
Copy link
 #7

  • Status changed from Pending release to Released

Updated by Alexis Mousset over 2 years ago Actions
Copy link
 #8

  • Private changed from Yes to No
Actions
Copy link

Also available in: PDF Atom