From 4d7b8fde236613f3b3984ce73401b765777a26a0 Mon Sep 17 00:00:00 2001 From: Aapo Talvensaari Date: Mon, 5 Aug 2024 11:57:31 +0300 Subject: [PATCH] chore(deps): bump openssl to 3.2.2 ### Summary - Fixed unbounded memory growth with session handling in TLSv1.3 Signed-off-by: Aapo Talvensaari --- .requirements | 4 ++-- build/openresty/openssl/openssl_repositories.bzl | 1 - changelog/unreleased/kong/bump_openssl.yml | 2 ++ scripts/explain_manifest/fixtures/amazonlinux-2-amd64.txt | 3 +-- scripts/explain_manifest/fixtures/amazonlinux-2023-amd64.txt | 2 +- scripts/explain_manifest/fixtures/amazonlinux-2023-arm64.txt | 2 +- scripts/explain_manifest/fixtures/debian-11-amd64.txt | 2 +- scripts/explain_manifest/fixtures/debian-12-amd64.txt | 2 +- scripts/explain_manifest/fixtures/el8-amd64.txt | 2 +- scripts/explain_manifest/fixtures/el9-amd64.txt | 2 +- scripts/explain_manifest/fixtures/el9-arm64.txt | 2 +- scripts/explain_manifest/fixtures/ubuntu-20.04-amd64.txt | 2 +- scripts/explain_manifest/fixtures/ubuntu-22.04-amd64.txt | 2 +- scripts/explain_manifest/fixtures/ubuntu-22.04-arm64.txt | 2 +- 14 files changed, 15 insertions(+), 15 deletions(-) create mode 100644 changelog/unreleased/kong/bump_openssl.yml diff --git a/.requirements b/.requirements index 989ac21cbfb..f3f1ae0b792 100644 --- a/.requirements +++ b/.requirements @@ -4,8 +4,8 @@ OPENRESTY=1.25.3.1 OPENRESTY_SHA256=32ec1a253a5a13250355a075fe65b7d63ec45c560bbe213350f0992a57cd79df LUAROCKS=3.11.1 LUAROCKS_SHA256=c3fb3d960dffb2b2fe9de7e3cb004dc4d0b34bb3d342578af84f84325c669102 -OPENSSL=3.2.1 -OPENSSL_SHA256=83c7329fe52c850677d75e5d0b0ca245309b97e8ecbcfdc1dfdc4ab9fac35b39 +OPENSSL=3.2.2 +OPENSSL_SHA256=197149c18d9e9f292c43f0400acaba12e5f52cacfe050f3d199277ea738ec2e7 PCRE=10.43 PCRE_SHA256=889d16be5abb8d05400b33c25e151638b8d4bac0e2d9c76e9d6923118ae8a34e LIBEXPAT=2.6.2 diff --git a/build/openresty/openssl/openssl_repositories.bzl b/build/openresty/openssl/openssl_repositories.bzl index bfd81811634..7cb96f59a84 100644 --- a/build/openresty/openssl/openssl_repositories.bzl +++ b/build/openresty/openssl/openssl_repositories.bzl @@ -20,6 +20,5 @@ def openssl_repositories(): strip_prefix = "openssl-" + version, urls = [ "https://github.com/openssl/openssl/releases/download/openssl-" + version + "/openssl-" + version + ".tar.gz", - "https://openssl.org/source/old/3.1/openssl-" + version + ".tar.gz", ], ) diff --git a/changelog/unreleased/kong/bump_openssl.yml b/changelog/unreleased/kong/bump_openssl.yml new file mode 100644 index 00000000000..5f6167d2275 --- /dev/null +++ b/changelog/unreleased/kong/bump_openssl.yml @@ -0,0 +1,2 @@ +message: "Bumped OpenSSL to 3.2.2, to fix unbounded memory growth with session handling in TLSv1.3" +type: dependency diff --git a/scripts/explain_manifest/fixtures/amazonlinux-2-amd64.txt b/scripts/explain_manifest/fixtures/amazonlinux-2-amd64.txt index 8a457c581da..f12655a7fe8 100644 --- a/scripts/explain_manifest/fixtures/amazonlinux-2-amd64.txt +++ b/scripts/explain_manifest/fixtures/amazonlinux-2-amd64.txt @@ -199,7 +199,7 @@ - lua-resty-lmdb - ngx_brotli - ngx_wasmx_module - OpenSSL : OpenSSL 3.2.1 30 Jan 2024 + OpenSSL : OpenSSL 3.2.2 4 Jun 2024 DWARF : True DWARF - ngx_http_request_t related DWARF DIEs: True @@ -211,4 +211,3 @@ - libdl.so.2 - libc.so.6 - ld-linux-x86-64.so.2 - diff --git a/scripts/explain_manifest/fixtures/amazonlinux-2023-amd64.txt b/scripts/explain_manifest/fixtures/amazonlinux-2023-amd64.txt index 7b5c7a0bf8e..eae65953bb5 100644 --- a/scripts/explain_manifest/fixtures/amazonlinux-2023-amd64.txt +++ b/scripts/explain_manifest/fixtures/amazonlinux-2023-amd64.txt @@ -188,7 +188,7 @@ - lua-resty-lmdb - ngx_brotli - ngx_wasmx_module - OpenSSL : OpenSSL 3.2.1 30 Jan 2024 + OpenSSL : OpenSSL 3.2.2 4 Jun 2024 DWARF : True DWARF - ngx_http_request_t related DWARF DIEs: True diff --git a/scripts/explain_manifest/fixtures/amazonlinux-2023-arm64.txt b/scripts/explain_manifest/fixtures/amazonlinux-2023-arm64.txt index dc4f126bab7..25d461da71a 100644 --- a/scripts/explain_manifest/fixtures/amazonlinux-2023-arm64.txt +++ b/scripts/explain_manifest/fixtures/amazonlinux-2023-arm64.txt @@ -195,7 +195,7 @@ - lua-resty-events - lua-resty-lmdb - ngx_wasmx_module - OpenSSL : OpenSSL 3.2.1 30 Jan 2024 + OpenSSL : OpenSSL 3.2.2 4 Jun 2024 DWARF : True DWARF - ngx_http_request_t related DWARF DIEs: True diff --git a/scripts/explain_manifest/fixtures/debian-11-amd64.txt b/scripts/explain_manifest/fixtures/debian-11-amd64.txt index 7647cdfb4f1..5bf0749717f 100644 --- a/scripts/explain_manifest/fixtures/debian-11-amd64.txt +++ b/scripts/explain_manifest/fixtures/debian-11-amd64.txt @@ -189,7 +189,7 @@ - lua-resty-lmdb - ngx_brotli - ngx_wasmx_module - OpenSSL : OpenSSL 3.2.1 30 Jan 2024 + OpenSSL : OpenSSL 3.2.2 4 Jun 2024 DWARF : True DWARF - ngx_http_request_t related DWARF DIEs: True diff --git a/scripts/explain_manifest/fixtures/debian-12-amd64.txt b/scripts/explain_manifest/fixtures/debian-12-amd64.txt index ebeb6014fe2..5377277e4c9 100644 --- a/scripts/explain_manifest/fixtures/debian-12-amd64.txt +++ b/scripts/explain_manifest/fixtures/debian-12-amd64.txt @@ -178,7 +178,7 @@ - lua-resty-lmdb - ngx_brotli - ngx_wasmx_module - OpenSSL : OpenSSL 3.2.1 30 Jan 2024 + OpenSSL : OpenSSL 3.2.2 4 Jun 2024 DWARF : True DWARF - ngx_http_request_t related DWARF DIEs: True diff --git a/scripts/explain_manifest/fixtures/el8-amd64.txt b/scripts/explain_manifest/fixtures/el8-amd64.txt index 629859f3ca6..483d1aae710 100644 --- a/scripts/explain_manifest/fixtures/el8-amd64.txt +++ b/scripts/explain_manifest/fixtures/el8-amd64.txt @@ -199,7 +199,7 @@ - lua-resty-lmdb - ngx_brotli - ngx_wasmx_module - OpenSSL : OpenSSL 3.2.1 30 Jan 2024 + OpenSSL : OpenSSL 3.2.2 4 Jun 2024 DWARF : True DWARF - ngx_http_request_t related DWARF DIEs: True diff --git a/scripts/explain_manifest/fixtures/el9-amd64.txt b/scripts/explain_manifest/fixtures/el9-amd64.txt index d1b29e97cb7..e8578693951 100644 --- a/scripts/explain_manifest/fixtures/el9-amd64.txt +++ b/scripts/explain_manifest/fixtures/el9-amd64.txt @@ -188,7 +188,7 @@ - lua-resty-lmdb - ngx_brotli - ngx_wasmx_module - OpenSSL : OpenSSL 3.2.1 30 Jan 2024 + OpenSSL : OpenSSL 3.2.2 4 Jun 2024 DWARF : True DWARF - ngx_http_request_t related DWARF DIEs: True diff --git a/scripts/explain_manifest/fixtures/el9-arm64.txt b/scripts/explain_manifest/fixtures/el9-arm64.txt index dc4f126bab7..25d461da71a 100644 --- a/scripts/explain_manifest/fixtures/el9-arm64.txt +++ b/scripts/explain_manifest/fixtures/el9-arm64.txt @@ -195,7 +195,7 @@ - lua-resty-events - lua-resty-lmdb - ngx_wasmx_module - OpenSSL : OpenSSL 3.2.1 30 Jan 2024 + OpenSSL : OpenSSL 3.2.2 4 Jun 2024 DWARF : True DWARF - ngx_http_request_t related DWARF DIEs: True diff --git a/scripts/explain_manifest/fixtures/ubuntu-20.04-amd64.txt b/scripts/explain_manifest/fixtures/ubuntu-20.04-amd64.txt index dcaa0ef9271..41a5961de8c 100644 --- a/scripts/explain_manifest/fixtures/ubuntu-20.04-amd64.txt +++ b/scripts/explain_manifest/fixtures/ubuntu-20.04-amd64.txt @@ -193,7 +193,7 @@ - lua-resty-lmdb - ngx_brotli - ngx_wasmx_module - OpenSSL : OpenSSL 3.2.1 30 Jan 2024 + OpenSSL : OpenSSL 3.2.2 4 Jun 2024 DWARF : True DWARF - ngx_http_request_t related DWARF DIEs: True diff --git a/scripts/explain_manifest/fixtures/ubuntu-22.04-amd64.txt b/scripts/explain_manifest/fixtures/ubuntu-22.04-amd64.txt index 60d62a4563c..372d8b99d49 100644 --- a/scripts/explain_manifest/fixtures/ubuntu-22.04-amd64.txt +++ b/scripts/explain_manifest/fixtures/ubuntu-22.04-amd64.txt @@ -182,7 +182,7 @@ - lua-resty-lmdb - ngx_brotli - ngx_wasmx_module - OpenSSL : OpenSSL 3.2.1 30 Jan 2024 + OpenSSL : OpenSSL 3.2.2 4 Jun 2024 DWARF : True DWARF - ngx_http_request_t related DWARF DIEs: True diff --git a/scripts/explain_manifest/fixtures/ubuntu-22.04-arm64.txt b/scripts/explain_manifest/fixtures/ubuntu-22.04-arm64.txt index 0d875dde28b..89d10983a04 100644 --- a/scripts/explain_manifest/fixtures/ubuntu-22.04-arm64.txt +++ b/scripts/explain_manifest/fixtures/ubuntu-22.04-arm64.txt @@ -183,7 +183,7 @@ - lua-resty-lmdb - ngx_brotli - ngx_wasmx_module - OpenSSL : OpenSSL 3.2.1 30 Jan 2024 + OpenSSL : OpenSSL 3.2.2 4 Jun 2024 DWARF : True DWARF - ngx_http_request_t related DWARF DIEs: True