docker-alpine New medium priority openssl vulnerability: CVE-2022-2097

There is a new vulnerability being reported by azure/container-scan and trivy on our builds: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2097 Also flagged by Snyk at: https://snyk.io/test/docker/alpine:3.16.0

I cannot find any workarounds. Looks like the alpine package for openssl needs to be updated with fixed version of openssl first.

Jul 06 '22 09:07 post-svejk

Is there any update on this issue?

Jul 15 '22 14:07 MarekKosinski

@MarekKosinski updating affected packages in Dockerfile may help

FROM alpine
RUN apk add --update-cache \
        libcrypto1.1=1.1.1q-r0 \
        libssl1.1=1.1.1q-r0 && \
    rm -rf /var/cache/apk/*

Jul 16 '22 20:07 kyberorg

FWIW, there is a new "edge" tag (20220715) available without this vuln. I tried the package upgrade suggested in https://github.com/alpinelinux/docker-alpine/issues/261#issuecomment-1186281774, but couldn't make it work - because of package conflicts...

Jul 17 '22 12:07 erikgb

@erikgb actually switching from https to http repositories helps somehow

RUN sed -i 's,https,http,g' /etc/apk/repositories && \
    apk add --update-cache \
        libcrypto1.1=1.1.1q-r0 \
        libssl1.1=1.1.1q-r0 && \
    rm -rf /var/cache/apk/*

Jul 17 '22 13:07 kyberorg

@kyberorg But doesn't that change make you vulnerable for MITM attacks, at least theoretically? Thanks for the info anyway!

Jul 17 '22 15:07 erikgb

FWIW, this might have been "medium" at some point but is now being reported as "high".

Jul 18 '22 09:07 famod

This does work but it is using the edge repository:

apk --no-cache add libcrypto1.1=1.1.1q-r0 libssl1.1=1.1.1q-r0 --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community

Jul 18 '22 10:07 SnazzyBootMan

@MarekKosinski updating affected packages in Dockerfile may help
FROM alpine
RUN apk add --update-cache \
        libcrypto1.1=1.1.1q-r0 \
        libssl1.1=1.1.1q-r0 && \
    rm -rf /var/cache/apk/*

Hi @MarekKosinski, Your suggestion fix my issue. Thanks.

Jul 18 '22 11:07 syukronarie

The OS patch just dropped; the new image should be imminent

Jul 18 '22 16:07 keithmattix

The OS patch just dropped; the new image should be imminent

yes, the image should provide this latest version..

Jul 19 '22 04:07 syukronarie

3.16.1 is available on DockerHub

Jul 19 '22 16:07 keithmattix

@keithmattix still seeing the same issue in 3.16.1.

The scan results show that 1 ISSUE was found for the image.

Vulnerable Packages Found
=========================

CVE-2022-30065

   Policy Status
   Active

   Summary
   A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.

   Vendor Security Notice IDs   Official Notice
   ALPINE-CVE-2022-30065

   Affected Packages   Policy Status   How to Resolve                        Security Notice
   busybox             Active          Upgrade busybox to >= 1.35.0-r17      ALPINE-CVE-2022-30065
   ssl_client          Active          Upgrade ssl_client to >= 1.35.0-r17   ALPINE-CVE-2022-30065

Jul 19 '22 20:07 sshuklao

@sshuklao I can confirm. Trivy gives same results.
Edge and 20220715 are shipping version 1.35.0-r18 and have 0 vulnerabilities.

Jul 19 '22 20:07 kyberorg

@sshuklao That's a separate vuln. Compare the 3.16.0 snyk report with the 3.16.1 snyk report

Jul 19 '22 20:07 keithmattix

@sshuklao @keithmattix The one about awk, CVE-2022-30065, has an open issue here: https://github.com/alpinelinux/docker-alpine/issues/264

But it is still true that the 3.16.1 release notes are claiming to fix that vulnerability, and it doesn't seem to be fixed.

Jul 19 '22 20:07 eli-darkly

Ah, yep; I didn't check the CVE link. Looks like 3.16.1 is still affected

Jul 19 '22 21:07 keithmattix

docker-alpine docker-alpine copied to clipboard

New medium priority openssl vulnerability: CVE-2022-2097

docker-alpine
docker-alpine copied to clipboard