From bd4c0572d1185807440110df3a7f159f086561cd Mon Sep 17 00:00:00 2001 From: Dongsu Park Date: Wed, 8 Feb 2023 08:55:01 +0100 Subject: [PATCH 1/3] dev-libs/openssl: update to 3.0.8 Sync with Gentoo, update dev-libs/openssl to 3.0.8, mainly to address CVE-2022-4203, CVE-2022-4304, CVE-2022-4450, CVE-2023-0215, CVE-2023-0216, CVE-2023-0217, CVE-2023-0286, CVE-2023-0401. --- .../coreos-overlay/dev-libs/openssl/Manifest | 4 +- ...entoo.config-1.0.2 => gentoo.config-1.0.4} | 16 +- .../dev-libs/openssl/files/openssl.conf | 3 - ...nssl-3.0.7.ebuild => openssl-3.0.8.ebuild} | 146 ++++-------------- 4 files changed, 46 insertions(+), 123 deletions(-) rename sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/{gentoo.config-1.0.2 => gentoo.config-1.0.4} (90%) delete mode 100644 sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/openssl.conf rename sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/{openssl-3.0.7.ebuild => openssl-3.0.8.ebuild} (64%) diff --git a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/Manifest b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/Manifest index 6c2b9eb6c9..8a76994a31 100644 --- a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/Manifest @@ -1,2 +1,2 @@ -DIST openssl-3.0.7.tar.gz 15107575 BLAKE2B 141881071fa62f056c514e7c653a61c59cc45fe951ec094041e23fb5e619133b7ebbfe31cd8203969c9d8842b8cbc10ec58da67cc181761a11c1cfdd0869df9a SHA512 6c2bcd1cd4b499e074e006150dda906980df505679d8e9d988ae93aa61ee6f8c23c0fa369e2edc1e1a743d7bec133044af11d5ed57633b631ae479feb59e3424 -DIST openssl-3.0.7.tar.gz.asc 858 BLAKE2B bd07a6f656cce817038743caf1131ef8d7a21bf587e706e32771ad9e09cb4821d21b71171a7fe7bb6bece95e9b06cea6d723aae9de8b62049b5a8316578500be SHA512 9093a8a5a990f5f37bd95e7ca55f2371e59242be408ea7d9403bcfc9c8873c022237e13c0ec81881a20607ea46927887a895a82b6f50c6f423b4c54f9ef0cde1 +DIST openssl-3.0.8.tar.gz 15151328 BLAKE2B e163cc9b8b458f72405a2f1bde3811c8d0eb22e8b08ff5608ec64799975f1546dcdce31466b8a1d5ed29bc90d19aa6017d711987c81b71f4b20e279828cf753a SHA512 8ce10be000d7d4092c8efc5b96b1d2f7da04c1c3a624d3a7923899c6b1de06f369016be957e36e8ab6d4c9102eaeec5d1973295d547f7893a7f11f132ae42b0d +DIST openssl-3.0.8.tar.gz.asc 833 BLAKE2B 1949801150e254e9be648f33014a4a16f803b42ca5a302c3942d377013e983e0ea0cca8aed594e3f9ecde26c6e31d222581e991af5fae6cd451d7ee83541f4bb SHA512 e1c04f1179aded228b39005fd9e9f6f75aedafb938b77ac58c97a00973eb412d93b92ad1c447332a5d96850b62b01093502928e6c190bdd0234a94c4e815d2a6 diff --git a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/gentoo.config-1.0.2 b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/gentoo.config-1.0.4 similarity index 90% rename from sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/gentoo.config-1.0.2 rename to sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/gentoo.config-1.0.4 index caa569588f..573a97de35 100644 --- a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/gentoo.config-1.0.2 +++ b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/gentoo.config-1.0.4 @@ -95,18 +95,22 @@ linux) # hppa64*) machine=parisc64;; hppa*) machine="generic32 -DB_ENDIAN";; i[0-9]86*|\ - x86_64*:x86) machine=elf;; + x86_64*:x86) machine=x86;; ia64*) machine=ia64;; - loongarch64*) machine="generic64 -DL_ENDIAN";; - m68*) machine="generic32 -DB_ENDIAN";; - mips*el*) machine="generic32 -DL_ENDIAN";; - mips*) machine="generic32 -DB_ENDIAN";; + loongarch64*) machine="loongarch64 -DL_ENDIAN" system=linux64;; + m68*) machine="latomic -DB_ENDIAN";; + mips*el*:o32) machine="mips32 -DL_ENDIAN";; + mips*:o32) machine="mips32 -DB_ENDIAN";; + mips*el*:n32) machine="mips64 -DL_ENDIAN";; + mips*:n32) machine="mips64 -DB_ENDIAN";; + mips*el*:n64) machine="mips64 -DL_ENDIAN" system=linux64;; + mips*:n64) machine="mips64 -DB_ENDIAN" system=linux64;; powerpc64*le*)machine=ppc64le;; powerpc64*) machine=ppc64;; powerpc*le*) machine="generic32 -DL_ENDIAN";; powerpc*) machine=ppc;; riscv32*) machine="generic32 -DL_ENDIAN";; - riscv64*) machine="generic64 -DL_ENDIAN";; + riscv64*) machine="riscv64 -DL_ENDIAN" system=linux64;; # sh64*) machine=elf;; sh*b*) machine="generic32 -DB_ENDIAN";; sh*) machine="generic32 -DL_ENDIAN";; diff --git a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/openssl.conf b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/openssl.conf deleted file mode 100644 index d8788d2929..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/openssl.conf +++ /dev/null @@ -1,3 +0,0 @@ -d /etc/ssl - - - - - -d /etc/ssl/private 0700 - - - - -L /etc/ssl/openssl.cnf - - - - ../../usr/share/ssl/openssl.cnf diff --git a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-3.0.7.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-3.0.8.ebuild similarity index 64% rename from sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-3.0.7.ebuild rename to sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-3.0.8.ebuild index f65e2d52f4..e259080c01 100644 --- a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-3.0.7.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-3.0.8.ebuild @@ -1,11 +1,10 @@ -# Copyright 1999-2022 Gentoo Authors +# Copyright 1999-2023 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 -EAPI=7 +EAPI=8 VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/openssl.org.asc -TMPFILES_OPTIONAL=1 -inherit edo flag-o-matic linux-info toolchain-funcs multilib-minimal multiprocessing verify-sig systemd tmpfiles +inherit edo flag-o-matic linux-info toolchain-funcs multilib-minimal multiprocessing verify-sig DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)" HOMEPAGE="https://www.openssl.org/" @@ -19,7 +18,8 @@ if [[ ${PV} == 9999 ]] ; then else SRC_URI="mirror://openssl/source/${MY_P}.tar.gz verify-sig? ( mirror://openssl/source/${MY_P}.tar.gz.asc )" - KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x86-linux" + #KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x86-linux" + KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86" fi S="${WORKDIR}"/${MY_P} @@ -30,7 +30,6 @@ IUSE="+asm cpu_flags_x86_sse2 fips ktls rfc3779 sctp static-libs test tls-compre RESTRICT="!test? ( test )" COMMON_DEPEND=" - >=app-misc/c_rehash-1.7-r1 tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] ) " BDEPEND=" @@ -41,7 +40,7 @@ BDEPEND=" sys-devel/bc sys-process/procps ) - verify-sig? ( >=sec-keys/openpgp-keys-openssl-20221101 )" + verify-sig? ( >=sec-keys/openpgp-keys-openssl-20230207 )" DEPEND="${COMMON_DEPEND}" RDEPEND="${COMMON_DEPEND}" @@ -51,9 +50,6 @@ MULTILIB_WRAPPED_HEADERS=( /usr/include/openssl/configuration.h ) -PATCHES=( -) - pkg_setup() { if use ktls ; then if kernel_is -lt 4 18 ; then @@ -62,6 +58,7 @@ pkg_setup() { CONFIG_CHECK="~TLS ~TLS_DEVICE" ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!" ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!" + use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER" linux-info_pkg_setup fi @@ -92,7 +89,7 @@ src_unpack() { src_prepare() { # Allow openssl to be cross-compiled - cp "${FILESDIR}"/gentoo.config-1.0.2 gentoo.config || die + cp "${FILESDIR}"/gentoo.config-1.0.4 gentoo.config || die chmod a+rx gentoo.config || die # Keep this in sync with app-misc/c_rehash @@ -115,19 +112,6 @@ src_prepare() { rm test/recipes/80-test_ssl_new.t || die fi - # - Make sure the man pages are suffixed (bug #302165) - # - Don't bother building man pages if they're disabled - # - Make DOCDIR Gentoo compliant - sed -i \ - -e '/^MANSUFFIX/s:=.*:=ssl:' \ - -e '/^MAKEDEPPROG/s:=.*:=$(CC):' \ - -e $(has noman FEATURES \ - && echo '/^install:/s:install_docs::' \ - || echo '/^MANDIR=/s:=.*:='${EPREFIX}'/usr/share/man:') \ - -e "/^DOCDIR/s@\$(BASENAME)@&-${PVR}@" \ - Configurations/unix-Makefile.tmpl \ - || die - # Quiet out unknown driver argument warnings since openssl # doesn't have well-split CFLAGS and we're making it even worse # and 'make depend' uses -Werror for added fun (bug #417795 again) @@ -146,21 +130,9 @@ src_prepare() { append-flags $(test-flags-CC -Wa,--noexecstack) - # Prefixify Configure shebang (bug #141906) - sed \ - -e "1s,/usr/bin/env,${BROOT}&," \ - -i Configure || die - - # Remove test target when FEATURES=test isn't set - if ! use test ; then - sed \ - -e '/^$config{dirs}/s@ "test",@@' \ - -i Configure || die - fi - - # The config script does stupid stuff to prompt the user. Kill it. - sed -i '/stty -icanon min 0 time 50; read waste/d' config || die - ./config --test-sanity || die "I AM NOT SANE" + local sslout=$(./gentoo.config) + einfo "Using configuration: ${sslout:-(openssl knows best)}" + edo perl Configure ${sslout} --test-sanity multilib_copy_sources } @@ -193,8 +165,6 @@ multilib_src_configure() { local sslout=$(./gentoo.config) einfo "Using configuration: ${sslout:-(openssl knows best)}" - local config="Configure" - [[ -z ${sslout} ]] && config="config" # https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features local myeconfargs=( @@ -227,36 +197,15 @@ multilib_src_configure() { threads ) - CFLAGS= LDFLAGS= edo ./${config} "${myeconfargs[@]}" - - # Clean out hardcoded flags that openssl uses - local DEFAULT_CFLAGS=$(grep ^CFLAGS= Makefile | LC_ALL=C sed \ - -e 's:^CFLAGS=::' \ - -e 's:\(^\| \)-fomit-frame-pointer::g' \ - -e 's:\(^\| \)-O[^ ]*::g' \ - -e 's:\(^\| \)-march=[^ ]*::g' \ - -e 's:\(^\| \)-mcpu=[^ ]*::g' \ - -e 's:\(^\| \)-m[^ ]*::g' \ - -e 's:^ *::' \ - -e 's: *$::' \ - -e 's: \+: :g' \ - -e 's:\\:\\\\:g' - ) - - # Now insert clean default flags with user flags - sed -i \ - -e "/^CFLAGS=/s|=.*|=${DEFAULT_CFLAGS} ${CFLAGS}|" \ - -e "/^LDFLAGS=/s|=[[:space:]]*$|=${LDFLAGS}|" \ - Makefile \ - || die + edo perl Configure "${myeconfargs[@]}" } multilib_src_compile() { - # depend is needed to use $confopts; it also doesn't matter - # that it's -j1 as the code itself serializes subdirs - emake -j1 depend + emake build_sw - emake all + if multilib_is_native_abi; then + emake build_docs + fi } multilib_src_test() { @@ -266,10 +215,15 @@ multilib_src_test() { } multilib_src_install() { - # We need to create ${ED}/usr on our own to avoid a race condition (bug #665130) - dodir /usr + emake DESTDIR="${D}" install_sw + if use fips; then + emake DESTDIR="${D}" install_fips + fi - emake DESTDIR="${D}" install + if multilib_is_native_abi; then + emake DESTDIR="${D}" install_ssldirs + emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} install_docs + fi # This is crappy in that the static archives are still built even # when USE=static-libs. But this is due to a failing in the openssl @@ -288,51 +242,19 @@ multilib_src_install_all() { dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el - # Namespace openssl programs to prevent conflicts with other man pages - cd "${ED}"/usr/share/man || die - local m d s - for m in $(find . -type f | xargs grep -L '#include') ; do - d=${m%/*} - d=${d#./} - m=${m##*/} - - [[ ${m} == openssl.1* ]] && continue - - [[ -n $(find -L ${d} -type l) ]] && die "erp, broken links already!" - - mv ${d}/{,ssl-}${m} || die - - # Fix up references to renamed man pages - sed -i '/^[.]SH "SEE ALSO"/,/^[.]/s:\([^(, ]*(1)\):ssl-\1:g' ${d}/ssl-${m} || die - ln -s ssl-${m} ${d}/openssl-${m} || die - - # Locate any symlinks that point to this man page - # We assume that any broken links are due to the above renaming - for s in $(find -L ${d} -type l) ; do - s=${s##*/} - - rm -f ${d}/${s} - - # We don't want to "|| die" here - ln -s ssl-${m} ${d}/ssl-${s} - ln -s ssl-${s} ${d}/openssl-${s} - done - done - [[ -n $(find -L ${d} -type l) ]] && die "broken manpage links found :(" + # Create the certs directory + keepdir ${SSL_CNF_DIR}/certs # bug #254521 dodir /etc/sandbox.d echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl - # flatcar changes: do not keep the sample CA files in `/etc` - rm -rf "${ED}"${SSL_CNF_DIR} - - # flatcar changes: save the default `openssl.cnf` in `/usr` - dodir /usr/share/ssl - insinto /usr/share/ssl - doins "${S}"/apps/openssl.cnf - dotmpfiles "${FILESDIR}"/openssl.conf - - # flatcar changes: package `tmpfiles.d` setup for SDK bootstrapping. - systemd-tmpfiles --create --root="${ED}" "${FILESDIR}"/openssl.conf + diropts -m0700 + keepdir ${SSL_CNF_DIR}/private +} + +pkg_postinst() { + ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)" + openssl rehash "${EROOT}${SSL_CNF_DIR}/certs" + eend $? } From 9cd2474a49507794ef5fdcf053fbe82716bba0f0 Mon Sep 17 00:00:00 2001 From: Mathieu Tortuyaux Date: Wed, 16 Mar 2022 10:40:40 +0100 Subject: [PATCH 2/3] dev-libs/openssl: Apply Flatcar modifications - remove unecessary files - drop `pkg_postint` - create `/etc/ssl` with tmpfiles - mark openssl as stable for arm64 and amd64 - continue shipping app-misc/c_rehash Signed-off-by: Mathieu Tortuyaux Signed-off-by: Dongsu Park --- .../dev-libs/openssl/files/openssl.conf | 3 ++ .../dev-libs/openssl/openssl-3.0.8.ebuild | 29 +++++++++++-------- 2 files changed, 20 insertions(+), 12 deletions(-) create mode 100644 sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/openssl.conf diff --git a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/openssl.conf b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/openssl.conf new file mode 100644 index 0000000000..d8788d2929 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/openssl.conf @@ -0,0 +1,3 @@ +d /etc/ssl - - - - - +d /etc/ssl/private 0700 - - - - +L /etc/ssl/openssl.cnf - - - - ../../usr/share/ssl/openssl.cnf diff --git a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-3.0.8.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-3.0.8.ebuild index e259080c01..27820abb08 100644 --- a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-3.0.8.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-3.0.8.ebuild @@ -4,7 +4,8 @@ EAPI=8 VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/openssl.org.asc -inherit edo flag-o-matic linux-info toolchain-funcs multilib-minimal multiprocessing verify-sig +TMPFILES_OPTIONAL=1 +inherit edo flag-o-matic linux-info toolchain-funcs multilib-minimal multiprocessing verify-sig systemd tmpfiles DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)" HOMEPAGE="https://www.openssl.org/" @@ -19,7 +20,7 @@ else SRC_URI="mirror://openssl/source/${MY_P}.tar.gz verify-sig? ( mirror://openssl/source/${MY_P}.tar.gz.asc )" #KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x86-linux" - KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86" + KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86" fi S="${WORKDIR}"/${MY_P} @@ -29,7 +30,11 @@ SLOT="0/3" # .so version of libssl/libcrypto IUSE="+asm cpu_flags_x86_sse2 fips ktls rfc3779 sctp static-libs test tls-compression vanilla verify-sig weak-ssl-ciphers" RESTRICT="!test? ( test )" +# Flatcar: Gentoo dropped dependency on c_rehash, a required tool for +# generating certs, and does not provide a built-in tool either. +# Continue shipping it. COMMON_DEPEND=" + >=app-misc/c_rehash-1.7-r1 tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] ) " BDEPEND=" @@ -242,19 +247,19 @@ multilib_src_install_all() { dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el - # Create the certs directory - keepdir ${SSL_CNF_DIR}/certs - # bug #254521 dodir /etc/sandbox.d echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl - diropts -m0700 - keepdir ${SSL_CNF_DIR}/private -} + # flatcar changes: do not keep the sample CA files in `/etc` + rm -rf "${ED}"${SSL_CNF_DIR} -pkg_postinst() { - ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)" - openssl rehash "${EROOT}${SSL_CNF_DIR}/certs" - eend $? + # flatcar changes: save the default `openssl.cnf` in `/usr` + dodir /usr/share/ssl + insinto /usr/share/ssl + doins "${S}"/apps/openssl.cnf + dotmpfiles "${FILESDIR}"/openssl.conf + + # flatcar changes: package `tmpfiles.d` setup for SDK bootstrapping. + systemd-tmpfiles --create --root="${ED}" "${FILESDIR}"/openssl.conf } From c39cb6df2f313b556a0d5c5809a78be06ab5c8ac Mon Sep 17 00:00:00 2001 From: Dongsu Park Date: Wed, 8 Feb 2023 09:35:01 +0100 Subject: [PATCH 3/3] changelog: add changelog for openssl 3.0.8 --- .../changelog/security/2023-02-08-openssl-3.0.8.md | 1 + .../coreos-overlay/changelog/updates/2023-02-08-openssl-3.0.8.md | 1 + 2 files changed, 2 insertions(+) create mode 100644 sdk_container/src/third_party/coreos-overlay/changelog/security/2023-02-08-openssl-3.0.8.md create mode 100644 sdk_container/src/third_party/coreos-overlay/changelog/updates/2023-02-08-openssl-3.0.8.md diff --git a/sdk_container/src/third_party/coreos-overlay/changelog/security/2023-02-08-openssl-3.0.8.md b/sdk_container/src/third_party/coreos-overlay/changelog/security/2023-02-08-openssl-3.0.8.md new file mode 100644 index 0000000000..c34c4ef379 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/changelog/security/2023-02-08-openssl-3.0.8.md @@ -0,0 +1 @@ +- OpenSSL ([CVE-2022-4203](https://nvd.nist.gov/vuln/detail/CVE-2022-4203), [CVE-2022-4304](https://nvd.nist.gov/vuln/detail/CVE-2022-4304), [CVE-2022-4450](https://nvd.nist.gov/vuln/detail/CVE-2022-4450), [CVE-2023-0215](https://nvd.nist.gov/vuln/detail/CVE-2023-0215), [CVE-2023-0216](https://nvd.nist.gov/vuln/detail/CVE-2023-0216), [CVE-2023-0217](https://nvd.nist.gov/vuln/detail/CVE-2023-0217), [CVE-2023-0286](https://nvd.nist.gov/vuln/detail/CVE-2023-0286), [CVE-2023-0401](https://nvd.nist.gov/vuln/detail/CVE-2023-0401)) diff --git a/sdk_container/src/third_party/coreos-overlay/changelog/updates/2023-02-08-openssl-3.0.8.md b/sdk_container/src/third_party/coreos-overlay/changelog/updates/2023-02-08-openssl-3.0.8.md new file mode 100644 index 0000000000..93cbff5d25 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/changelog/updates/2023-02-08-openssl-3.0.8.md @@ -0,0 +1 @@ +- OpenSSL ([3.0.8](https://github.com/openssl/openssl/blob/openssl-3.0.8/NEWS.md#major-changes-between-openssl-307-and-openssl-308-7-feb-2023))