CVE on curl-7.80.0, openssl-1.1.1l

[JunXie-ZH]

对nebula的二进制文件（主要是bin文件夹下的几个文件）进行了扫描，发现依赖开源组件curl-7.80.0、openssl-1.1.1l，这两个组件都是存在一些CVE漏洞的。这个官方有分析过不，nebula使用场景会触发这些漏洞吗

[wey-gu]

@MuYiYong @Shinji-IkariG should we uplift to a version w/o CVE?

[Shinji-IkariG]

Thank you for reporting the CVE incident. We will conduct a unified check and fix the upstream dependencies.

[Shinji-IkariG]

@MuYiYong @Shinji-IkariG should we uplift to a version w/o CVE?

I think we should first confirm the number and impact of CVE incidents in all 3rd components. Let’s see what form the repair takes.

[wey-gu]

@JunXie-ZH, btw. those two libs were not used by default.

• the condition to trigger OpenSSL is when TLS between services is enabled
• the curl is now only used when Full-text search is used(to talk to elastic search)

[JunXie-ZH]

@wey-gu Thanks! And what about the zlib? When will it be used?

[wey-gu]

@wey-gu Thanks! And what about the zlib? When will it be used?

RocksDB leverages zlib as the compression lib, which is optional, and by default not used, lz4 instead is the default compression lib.

--rocksdb_compression=lz4