Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove OpenSSL from the dependency tree on all platforms #2799

Closed
5 tasks done
romac opened this issue Nov 2, 2022 · 0 comments · Fixed by #2800
Closed
5 tasks done

Remove OpenSSL from the dependency tree on all platforms #2799

romac opened this issue Nov 2, 2022 · 0 comments · Fixed by #2800
Assignees
Labels
O: security Objective: cause to enhance security and improve safety
Milestone

Comments

@romac
Copy link
Member

romac commented Nov 2, 2022

Summary of Bug

OpenSSL released a security advisory on November 1st which contains two CVE with severity HIGH.

While Hermes is mostly using the Rustls TLS implementation which is not affected, we should ensure that we do not depend on OpenSSL at all to avoid opening up the door for such vulnerabilities in the future.

At the moment, only the ibc-chain-registry transitively depends on OpenSSL on Linux via the reqwest crate which is used to fetch data from the chain registry on GitHub.

Version

master

Steps to Reproduce

Either on Linux or with the x86_64-unknown-linux-gnu toolchain installed:

$ git clone https://github.com/informalsystems/hermes
$ cd hermes
$ cargo tree --target x86_64-unknown-linux-gnu -i openssl-sys
openssl-sys v0.9.77
├── native-tls v0.2.10
│   ├── hyper-tls v0.5.0
│   │   └── reqwest v0.11.12
│   │       └── ibc-chain-registry v0.1.0 (/hermes/crates/ibc-chain-registry)
│   │           └── ibc-relayer-cli v1.1.0 (/hermes/crates/relayer-cli)
│   │               ├── check-guide v0.1.0 (/hermes/tools/check-guide)
│   │               ├── ibc-integration-test v0.20.0 (/hermes/tools/integration-test)
│   │               └── ibc-test-framework v0.20.0 (/hermes/tools/test-framework)
│   │                   └── ibc-integration-test v0.20.0 (/hermes/tools/integration-test)
│   ├── reqwest v0.11.12 (*)
│   └── tokio-native-tls v0.3.0
│       ├── hyper-tls v0.5.0 (*)
│       └── reqwest v0.11.12 (*)
└── openssl v0.10.42
    └── native-tls v0.2.10 (*)

Acceptance Criteria

The commands above do not mention openssl, openssl-sys nor native-tls.


For Admin Use

  • Not duplicate issue
  • Appropriate labels applied
  • Appropriate milestone (priority) applied
  • Appropriate contributors tagged
  • Contributor assigned/self-assigned
@romac romac added the O: security Objective: cause to enhance security and improve safety label Nov 2, 2022
@romac romac added this to the v1.2 milestone Nov 2, 2022
@romac romac self-assigned this Nov 2, 2022
@romac romac changed the title Remove OpenSSL from the dependency tree Remove OpenSSL from the dependency tree on all platforms Nov 2, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
O: security Objective: cause to enhance security and improve safety
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant