debian stable-slim base image used in docker image fleetdm/fleetctl contains critical vulnerability in libssl1.1

[efasel]

Fleet version: v4.54.0

Web browser and operating system: –

---

💥  Actual behavior

result of trivy scanner:

┌───────────┬───────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────┐
│  Library  │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │                         Title                         │
├───────────┼───────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────┤
│ libssl1.1 │ CVE-2022-1292 │ CRITICAL │ fixed  │ 1.1.1n-0+deb11u4  │ 1.1.1o-1      │ openssl: c_rehash script allows command injection     │
│           │               │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2022-1292             │
│           ├───────────────┤          │        │                   ├───────────────┼───────────────────────────────────────────────────────┤
│           │ CVE-2022-2068 │          │        │                   │ 3.0.4-1       │ openssl: the c_rehash script allows command injection │
│           │               │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2022-2068             │
│           ├───────────────┤          │        │                   ├───────────────┼───────────────────────────────────────────────────────┤
│           │ CVE-2022-2274 │          │        │                   │ 3.0.4-2       │ openssl: AVX-512-specific heap buffer overflow        │
│           │               │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2022-2274             │
└───────────┴───────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────┘

🧑‍💻  Steps to reproduce

–

🕯️ More info (optional)

• Dockerfile: https://github.com/fleetdm/fleet/blob/5413f8d2b2bcb89153a25870883e9de0ac703c2e/tools/fleetctl-docker/Dockerfile#L9

update to latest debian stable-slim image: https://hub.docker.com/_/debian/tags?page=&page_size=&ordering=&name=stable-slim

QA notes

To test these changes you will need to build fleetdm/wix, fleetdm/bomutils and fleetdm/fleetctl locally (which should overwrite the remote tags):

The following should be tested on a macOS AND a Linux host (with Docker installed):

make wix-docker
make bomutils-docker
make fleetctl-docker

Then test generating all the pkg|msi|deb|rpm packages both with the fleetctl executable (as usual) and with the fleetdm/fleetctl docker image.

• Using fleetctl executable is the usual way we build packages.
• Using fleetdm/fleetctl is similar invocation but using docker instead of the fleetctl executable: docker run -v "$(pwd):/build" fleetdm/fleetctl package --type ... --enroll-secret=foo --fleet-url=https://localhost:8080

[xpkoala]

Thank you for the ticket on this @efasel. I've alerted our team and we will be assessing asap.

[lukeheath]

@efasel Thank you for calling this out for us! We'll have a fix merged shortly.

@sharon-fdm We have an open PR to update the base image that is building for everything except PKG. @rfairburn started on this but is out for a couple of weeks, so I'm sending this to EO for triage and to get it over the finish line. Since this is a security issue, I'm escalating to a P2 to expedite.

[valentinpezon-primo]

Hi !

Since we have Vanta in our system, the docker image that we store on our cloud gives us a lot of VULN alerts

openSSL is one of them but they are many more (see screen)

It will block us in our SOC2 certification if we are not able to get the most critial one fixed

Is it possible to tackle them aswell ?

Thanks 🙏

[lukeheath]

@valentinpezon-primo Thanks for the heads up!

@sharon-fdm @lucasmrod Can we tackle the additional vulns reported by @valentinpezon-primo as part of this bug, or should we open a separate bug ticket?

[lucasmrod]

UPDATE:

• To build pkgs, the fleetctl executable uses the fleetdm/bomutils docker image.
• We also offer the fleetdm/fleetctl docker image that contains the fleetctl executable + all its dependencies. Such dependencies are copied from the fleetdm/bomutils docker image itself when building the image.

So, we need to update the base images of both fleetdm/bomutils and fleetdm/fleetctl. (This is why we increased the estimation from 3 to 5.)

[lucasmrod]

@xpkoala Added QA notes.