Classify the SLE 15 SP7 OpenSSL package findings - #37
Conversation
|
Three more CVEs in this batch are backported into the shipped
CVE-2025-27587 is additionally inapplicable to what we publish: it is PPC-specific and our images are amd64/arm64 only. Negative control for the absence results: the same decode finds 75 distinct CVEs in the One note on the two statements not resting on a backport: CVE-2025-11187 and CVE-2025-15468 are absent from the changelog, which is consistent with your "never affected" reasoning (PBMAC1 and QUIC postdate 3.2.3) rather than contradicting it — worth keeping those two justifications visibly distinct from the backport ones, since they carry different residual risk at renewal. Context for the coverage gap this leaves: the shipped From the |
LouisLotter
changed the title
Grype's database gained four HIGH openssl advisories whose fixed version resolves to SUSE's 3.5.0-150700.5.45.2 rebase. Every SUSE Observability image built on bci-base or bci/openjdk ships openssl-3 3.2.3-150700.5.40.1 and openssl 3.2.3-150700.1.1, so a plain version comparison reports all of them vulnerable. Dev chart scan 33247001935 has CVE-2026-2673 on libopenssl3 gating 23 of 28 failing images across docker-images, stackstate, stackgraph and stackstate-ailab, and it has already turned docker-images builds red on a previously green commit. None of the four applies to the 3.2.3 stream: - CVE-2024-9143: SUSE lists SP7 fixed at openssl-3 >= 3.2.3-150700.3.20, an earlier release of the stream we ship, and openssl-CVE-2024-9143.patch is in the rpm changelog. - CVE-2024-12797: introduced in OpenSSL 3.2 so in range on version alone, but openssl-CVE-2024-12797.patch is in the rpm changelog. - CVE-2025-11187: PBMAC1 PKCS#12 validation, code present only in 3.4 to 3.6. - CVE-2025-15468: QUIC SSL_CIPHER_find, affects 3.3 to 3.6, and SUSE lists 3.0 and earlier as not affected. Lane 1 per CONTRIBUTING, because the assertion is a property of the package and is identical in every image that carries it. Verified that Grype honours it: the four statements move all 16 findings to ignoredMatches on both zookeeper:3.9.5-so21 and elasticsearch:8.19.16-so12, leaving zookeeper with no HIGH or CRITICAL findings at all. Products are pinned to the exact versions the scan measured rather than the whole 3.2.3 line, so the changelog evidence stays verifiable and the statement needs re-review when SLE-BCI moves openssl. Refs #36 Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
Record five exact RPM backports as fixed, retain the PBMAC1 finding as not affected where the code is absent, and leave CVE-2025-15468 active for the libssl-bearing packages. The FIPS-only and documentation-only packages now have evidence appropriate to their actual contents instead of inheriting the library claim. Refs #36 Co-authored-by: Louis Lotter <louis.lotter@suse.com>
711b812 to
21a374e
Compare
2 participants
Classifies the OpenSSL findings by actual RPM contents:
Validation: the generated index is current; the 60-row Spotlight Grype result becomes 34 active and 26 VEX-filtered.
Fixes #36