New OpenSSL vulnerabilities (08/06/2014) about docker-brew-ubuntu-core

[tianon]

Do we have another fun oneliner to easily verify vulnerability status of an image? Just grepping for "ssl" in the installed packages again?

[tianon]

Here's the changelog of the latest update to openssl in 12.04:

http://changelogs.ubuntu.com/changelogs/pool/main/o/openssl/openssl_1.0.1-4ubuntu5.16/changelog

openssl (1.0.1-4ubuntu5.16) precise-security; urgency=medium

  * SECURITY UPDATE: regression with certain renegotiations (LP: #1332643)
    - debian/patches/CVE-2014-0224-regression2.patch: accept CCS after
      sending finished ssl/s3_clnt.c.

 -- Marc Deslauriers <[email protected]>  Fri, 20 Jun 2014 13:57:48 -0400

Note that date. There's not even an USN filed for this yet: http://www.ubuntu.com/usn/

[tianon]

And here's trusty: http://changelogs.ubuntu.com/changelogs/pool/main/o/openssl/openssl_1.0.1f-1ubuntu2.4/changelog

openssl (1.0.1f-1ubuntu2.4) trusty-security; urgency=medium

  * SECURITY UPDATE: regression with certain renegotiations (LP: #1332643)
    - debian/patches/CVE-2014-0224-regression2.patch: accept CCS after
      sending finished ssl/s3_clnt.c.

 -- Marc Deslauriers <[email protected]>  Fri, 20 Jun 2014 13:55:11 -0400

[tianon]

So rebuilding this image right now looks like it would be fairly pointless, since it won't have an update yet anyhow.

[shin-]

Looks like it's just been fixed for utopic: https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu7

[tianon]

So now we get to wait until this hits Ubuntu Core, which will be tomorrow (and might give a chance for other suites to get it too).

[Scorpiion]

Any update on this issue @tianon?

[tianon]

The images were updated for this a while ago, but now we have much better support as of docker-library/official-images#340, so we should be in much better shape when the next problem drops.

[Scorpiion]

👍