Rebase Latest Exchange Container Images To Include OpenSSL v3.0.7 Update

[naphelps]

OpenSSL v3.x has a critical high security vulnerability that needs to patched. This version of OpenSSL is included in Red Hat's UBI 9. The patch to fix this vulnerability is to be released November 1, 2022. Once this patch is released to the UBI 9 repository, the Open Horizon team is to rebuild and release new Exchange container images to include the fix for this vulnerability.

[johnwalicki]

Follow the availability of the ubi9/ubi9-minimal container at
https://catalog.redhat.com/software/containers/search

[naphelps]

@johnwalicki OpenSSL is not included in the base minimal image by default it must be installed from the UBI repository as an added layer.

https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/o/

exchange-api/build.sbt

Line 139 in aa725df

Cmd("RUN", "mkdir -p /run/user/$UID && microdnf update -y --nodocs && microdnf install -y --nodocs shadow-utils gettext java-17-openjdk openssl && microdnf clean all"),

[johnwalicki]

Right..., my OH code searches found that build.sbt yesterday. The microdnf install adds the openssl package to the exchange container. We'll just need to re-run the build pipeline

https://github.com/open-horizon/exchange-api/blob/master/build.sbt

[johnwalicki]

In the abundance of clarity, we should bump the exchange build number (which I think is an artifact of the build process?) so that we can tell users the minimum release ver to upgrade to.

[naphelps]

That has already been done, pulling v2.87.4 from the latest released branch or anything v2.102.0+ from the master branch will cover you.

#617
#648

[naphelps]

Posted CVEs have been downgraded from critical to high.

https://www.openssl.org/news/vulnerabilities.html#CVE-2022-3786

[johnwalicki]

@bencourliss Here is the RHEL 9 errata for OpenSSL 3.0.7
An update for openssl is now available for Red Hat Enterprise Linux 9.
https://access.redhat.com/errata/RHSA-2022:7288

[johnwalicki]

Can you kick off a build to generate a refreshed Exchange container with this updated OpenSSL 3.0.7 errata?

[naphelps]

The updated packages have not hit the repository yet. The UBI repositories typically lag behind the RHEL ones.

[bencourliss]

I have confirmed with RedHat that the openssl-3.0.1-43.el9_0.x86_64.rpm contains the backported fixes for CVE-2022-3602 and CVE-2022-3786. These have been included in the latest build of ExchangeAPI (version 2.106.0+) and will be published to Dockerhub as soon as a passing e2edev test completes from the Anax side.

[naphelps]

Issue resolved, closing.

[johnwalicki]

Refreshed exchange container has been posted to DockerHub today. Thanks @bencourliss

https://hub.docker.com/layers/openhorizon/amd64_exchange-api/testing/images/sha256-a9c0918b6ac11d86cd6378ae6280614ed19c7d989cd283fb21628820790356ec?context=explore