Image built with this graalvm maven got openssl-3.0.2, which has vulnerabilities.

[KafkaProServerless]

Hello team,

I am using this image to build containers.
The container works fine, this image is great.

Unfortunately, we have daily scans of images built with these images.
All images are being flagged using openssl-3.0.2, which has many vulnerabilities.

May I ask if it is possible to bump openssl to a safe version?
Thank you

[KafkaProServerless]

CVE-2022-1292
Row: 1; Column: 1

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).
Row: 1; Column: 2

CVE-2022-1473
Row: 2; Column: 1

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
Row: 2; Column: 2

CVE-2022-2068
Row: 3; Column: 1

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).
Row: 3; Column: 2

And many more

[sebthom]

The image has openssl 3.0.11 installed, which you can verify by running:

docker run --rm -it vegardit/graalvm-maven:latest-java17 openssl version
OpenSSL 3.0.11 19 Sep 2023 (Library: OpenSSL 3.0.11 19 Sep 2023)

The openssl version comes from the package repo for debian:stable-slim docker image. If that is not sufficient you may need to raise an issue against the base docker image.

[sebthom]

FWIW I added a docker image scan with trivy to the build workflow which will fail the image build if open CVEs are found for which fixes are available.

[KafkaProServerless]

Thanks a lot