This project is supported under the Linux Foundation CRA stewardship framework, as described at https://www.linuxfoundation.org/security. Security vulnerabilities should be reported through the mechanisms described below, which we will coordinate with our CRA steward. For actively exploited vulnerabilities and severe incidents that may require CRA escalation, please use the project’s emergency security reporting mechanisms as appropriate.
Please report any potential security issues to <open-horizon-security@lists.lfedge.org>. This will notify the core project team who will respond accordingly.
- On November 1 2022, the OpenSSL community released OpenSSL 3.0.7 which detailed two vulnerability alerts; CVE-2022-3786 and CVE-2022-3602. Both high severity CVE alerts related to x.509 certificate verification buffer overruns.
- Open Horizon is not affected by these CVE security alerts
- Open Horizon uses TLS encryption in the anax / exchange / css / vault / SDO components via the Go crypto/tls library.
- Several Open Horizon components use the OpenSSL 1.x command line utilities to generate x.509 certificates / keys within containers and for testing.
- Only the Open Horizon Exchange UBI9 based container includes the OpenSSL 3.0.x package to generate x.509 certificates. This usage is not affected by the CVE alerts resolved by OpenSSL 3.0.7
- In the abundance of caution, the Exchange UBI9 container with the recently released OpenSSL 3.0.7 package will be rebuilt. That work is being tracked by Exchange API Issue #650
- Open Horizon is not affected by these CVE security alerts
[comment]: <> - Open Horizon users can upgrade by pulling v2.87.4+ from the latest released branch or anything v2.102.0+ from the master branch.