Repository navigation
node:12.13/14-slim ships with unsupported OpenSSL? #1181
Description
See in https://www.openssl.org/policies/releasestrat.html
Version 1.1.1 will be supported until 2023-09-11 (LTS).
Version 1.1.0 will be supported until 2019-09-11.
In the latest node:12.13-slim, openssl version returns OpenSSL 1.1.0l 10 Sep 2019
Activity
[-]node:12.13-slim ships with unsupported OpenSSL?[/-][+]node:12.13/14-slim ships with unsupported OpenSSL?[/+]IdanAdar commentedon Jan 7, 2020
@SimenB In reading through the comments of your PR it seems that you're basically dropping OpenSSL completely from the base image, which means I guess that I should install it myself, but I tried this and it still installed that same old OpenSSL version, so how is this helping to resolve the issue? How do I then install the latest OpenSSL version?
SimenB commentedon Jan 7, 2020
I don't know if it's been released for stretch? You could use buster, which is debian 10 instead of debian 9.
This will solve it in that we will no longer ship an image with openssl installed. How to install a given version of
opensslintodebian:stretch-slimis a separate issue. A quick google seems to indicate it cannot be done out of the box: https://www.reddit.com/r/debian/comments/b3rbf2/openssl_111_tls_13_under_debian_stretch/IdanAdar commentedon Jan 8, 2020
Well, we're using node:12.13-slim, that one is using debian 9 no? Not much I can do about that... unless someone updates slim to use debian 10.
SimenB commentedon Jan 8, 2020
We have buster images,
docker run node:12.13-buster-slimIdanAdar commentedon Jan 8, 2020
So with
node:12.13-buster-slimas-is todayapt-get install opensslshould provide OpenSSL 1.1.1d?SimenB commentedon Jan 8, 2020
You might need
apt-get updatefirst but otherwise yeahbrandonw commentedon Jul 21, 2020
Removing the package causes any new images that are based off of these images to no longer have a default config, which implicitly reduces the SECLEVEL for all openssl usage on that image.
It may be useful to notify consumers of this image that they should configure a reasonable
openssl.cnfin the Best Practices section of the README.I can't find any release notes for these images, but if they exist, an amended release note that if you use openssl, an
openssl.cnfmust now be configured in each image instead of inheriting the packageopenssl.cnfwould also be useful.