openssl: CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2016-6305, CVE-2016-6306, CVE-2016-6307, CVE-2016-6308 #2171

tianon · 2016-09-22T17:50:52Z

CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2016-6305, CVE-2016-6306, CVE-2016-6307, CVE-2016-6308

https://www.openssl.org/news/secadv/20160922.txt

CVE-2016-2177: https://www.openssl.org/news/vulnerabilities.html#2016-2177

Fixed in OpenSSL 1.0.1u (Affected 1.0.1t, 1.0.1s, 1.0.1r, 1.0.1q, 1.0.1p, 1.0.1o, 1.0.1n, 1.0.1m, 1.0.1l, 1.0.1k, 1.0.1j, 1.0.1i, 1.0.1h, 1.0.1g, 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)
Fixed in OpenSSL 1.0.2i (Affected 1.0.2h, 1.0.2g, 1.0.2f, 1.0.2e, 1.0.2d, 1.0.2c, 1.0.2b, 1.0.2a, 1.0.2)

CVE-2016-2178: https://www.openssl.org/news/vulnerabilities.html#2016-2178

Fixed in OpenSSL 1.0.1u (Affected 1.0.1t, 1.0.1s, 1.0.1r, 1.0.1q, 1.0.1p, 1.0.1o, 1.0.1n, 1.0.1m, 1.0.1l, 1.0.1k, 1.0.1j, 1.0.1i, 1.0.1h, 1.0.1g, 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)
Fixed in OpenSSL 1.0.2i (Affected 1.0.2h, 1.0.2g, 1.0.2f, 1.0.2e, 1.0.2d, 1.0.2c, 1.0.2b, 1.0.2a, 1.0.2)

CVE-2016-2179: https://www.openssl.org/news/vulnerabilities.html#2016-2179

Fixed in OpenSSL 1.0.1u (Affected 1.0.1t, 1.0.1s, 1.0.1r, 1.0.1q, 1.0.1p, 1.0.1o, 1.0.1n, 1.0.1m, 1.0.1l, 1.0.1k, 1.0.1j, 1.0.1i, 1.0.1h, 1.0.1g, 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)
Fixed in OpenSSL 1.0.2i (Affected 1.0.2h, 1.0.2g, 1.0.2f, 1.0.2e, 1.0.2d, 1.0.2c, 1.0.2b, 1.0.2a, 1.0.2)

CVE-2016-2180: https://www.openssl.org/news/vulnerabilities.html#2016-2180

Fixed in OpenSSL 1.0.1u (Affected 1.0.1t, 1.0.1s, 1.0.1r, 1.0.1q, 1.0.1p, 1.0.1o, 1.0.1n, 1.0.1m, 1.0.1l, 1.0.1k, 1.0.1j, 1.0.1i, 1.0.1h, 1.0.1g, 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)
Fixed in OpenSSL 1.0.2i (Affected 1.0.2h, 1.0.2g, 1.0.2f, 1.0.2e, 1.0.2d, 1.0.2c, 1.0.2b, 1.0.2a, 1.0.2)

CVE-2016-2181: https://www.openssl.org/news/vulnerabilities.html#2016-2181

Fixed in OpenSSL 1.0.1u (Affected 1.0.1t, 1.0.1s, 1.0.1r, 1.0.1q, 1.0.1p, 1.0.1o, 1.0.1n, 1.0.1m, 1.0.1l, 1.0.1k, 1.0.1j, 1.0.1i, 1.0.1h, 1.0.1g, 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)
Fixed in OpenSSL 1.0.2i (Affected 1.0.2h, 1.0.2g, 1.0.2f, 1.0.2e, 1.0.2d, 1.0.2c, 1.0.2b, 1.0.2a, 1.0.2)

CVE-2016-2182: https://www.openssl.org/news/vulnerabilities.html#2016-2182

Fixed in OpenSSL 1.0.1u (Affected 1.0.1t, 1.0.1s, 1.0.1r, 1.0.1q, 1.0.1p, 1.0.1o, 1.0.1n, 1.0.1m, 1.0.1l, 1.0.1k, 1.0.1j, 1.0.1i, 1.0.1h, 1.0.1g, 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)
Fixed in OpenSSL 1.0.2i (Affected 1.0.2h, 1.0.2g, 1.0.2f, 1.0.2e, 1.0.2d, 1.0.2c, 1.0.2b, 1.0.2a, 1.0.2)

CVE-2016-2183: https://www.openssl.org/news/vulnerabilities.html#2016-2183 (does not appear to be listed on "vulnerabilities.html"); https://sweet32.info/

OpenSSL 1.0.2 users should upgrade to 1.0.2i
OpenSSL 1.0.1 users should upgrade to 1.0.1u

CVE-2016-6302: https://www.openssl.org/news/vulnerabilities.html#2016-6302

Fixed in OpenSSL 1.0.1u (Affected 1.0.1t, 1.0.1s, 1.0.1r, 1.0.1q, 1.0.1p, 1.0.1o, 1.0.1n, 1.0.1m, 1.0.1l, 1.0.1k, 1.0.1j, 1.0.1i, 1.0.1h, 1.0.1g, 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)
Fixed in OpenSSL 1.0.2i (Affected 1.0.2h, 1.0.2g, 1.0.2f, 1.0.2e, 1.0.2d, 1.0.2c, 1.0.2b, 1.0.2a, 1.0.2)

CVE-2016-6303: https://www.openssl.org/news/vulnerabilities.html#2016-6303

Fixed in OpenSSL 1.0.1u (Affected 1.0.1t, 1.0.1s, 1.0.1r, 1.0.1q, 1.0.1p, 1.0.1o, 1.0.1n, 1.0.1m, 1.0.1l, 1.0.1k, 1.0.1j, 1.0.1i, 1.0.1h, 1.0.1g, 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)
Fixed in OpenSSL 1.0.2i (Affected 1.0.2h, 1.0.2g, 1.0.2f, 1.0.2e, 1.0.2d, 1.0.2c, 1.0.2b, 1.0.2a, 1.0.2)

CVE-2016-6304: https://www.openssl.org/news/vulnerabilities.html#2016-6304

Fixed in OpenSSL 1.0.1u (Affected 1.0.1t, 1.0.1s, 1.0.1r, 1.0.1q, 1.0.1p, 1.0.1o, 1.0.1n, 1.0.1m, 1.0.1l, 1.0.1k, 1.0.1j, 1.0.1i, 1.0.1h, 1.0.1g, 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)
Fixed in OpenSSL 1.0.2i (Affected 1.0.2h, 1.0.2g, 1.0.2f, 1.0.2e, 1.0.2d, 1.0.2c, 1.0.2b, 1.0.2a, 1.0.2)
Fixed in OpenSSL 1.1.0a (Affected 1.1.0)

CVE-2016-6305: https://www.openssl.org/news/vulnerabilities.html#2016-6305

Fixed in OpenSSL 1.1.0a (Affected 1.1.0)

CVE-2016-6306: https://www.openssl.org/news/vulnerabilities.html#2016-6306

Fixed in OpenSSL 1.0.1u (Affected 1.0.1t, 1.0.1s, 1.0.1r, 1.0.1q, 1.0.1p, 1.0.1o, 1.0.1n, 1.0.1m, 1.0.1l, 1.0.1k, 1.0.1j, 1.0.1i, 1.0.1h, 1.0.1g, 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)
Fixed in OpenSSL 1.0.2i (Affected 1.0.2h, 1.0.2g, 1.0.2f, 1.0.2e, 1.0.2d, 1.0.2c, 1.0.2b, 1.0.2a, 1.0.2)

CVE-2016-6307: https://www.openssl.org/news/vulnerabilities.html#2016-6306

Fixed in OpenSSL 1.1.0a (Affected 1.1.0)

CVE-2016-6308: https://www.openssl.org/news/vulnerabilities.html#2016-6306

Fixed in OpenSSL 1.1.0a (Affected 1.1.0)

The text was updated successfully, but these errors were encountered:

tianon · 2016-09-22T17:53:45Z

@bryteise are there any good links for CVE-tracking WRT Clear Linux? 🙏

bryteise · 2016-09-22T18:05:58Z

@tianon I'm sorry we do not have anything externally facing that can be linked to for the issue. It is something that is being looked at but I do not have any timeline for availability =(.

This is something that is definitely being tracked and we are looking to make a release as soon as possible for these.

tianon · 2016-09-22T18:10:14Z

@bryteise ok, that's good enough; thanks! 👍

tianon · 2016-09-22T23:02:19Z

Looks like we've a few fixes available upstream. 😄

@andyshinn alpine looks updated!

@prologic crux looks updated! (https://crux.nu/gitweb/?p=ports/core.git;a=commit;h=5f0151ef41df86a94eb7ef5baab7d0c988515439)

@frapposelli photon looks updated! (vmware/photon@5d2fa23; not sure what it takes for it to move from dev to master 😇)

@vaygr sourcemage looks updated! (http://scmweb.sourcemage.org/?p=smgl/grimoire.git;a=commit;h=c4937fa93fc0d46ff07e3d31f10e9824faadb89f)

🙏

tianon · 2016-09-22T23:02:39Z

(Ubuntu is in progress, as is Debian)

See also docker-library/official-images#2171.

tianon · 2016-09-26T16:57:17Z

ARRRRG https://www.openssl.org/news/secadv/20160926.txt

tianon · 2016-09-26T21:03:53Z

At least Debian and Ubuntu appear to be unaffected by this new advisory (https://security-tracker.debian.org/tracker/CVE-2016-7052, <not-affected> (Introduced in 1.0.2i)).

tianon · 2017-02-14T22:44:35Z

I think this is likely as good as it's going to get at this point. 👍

tianon added the cve-tracker label Sep 22, 2016

andyshinn mentioned this issue Sep 22, 2016

OpenSSL 1.0.2i for Alpine CVEs #2174

Merged

tianon added a commit to docker-library/tomcat that referenced this issue Sep 23, 2016

Update OPENSSL_VERSION to 1.0.2i-1

e7ba4eb

See also docker-library/official-images#2171.

This was referenced Sep 23, 2016

Update Debian, especially for DSA-3673-1 #2179

Merged

Update Ubuntu, especially for USN-3087-1 and USN-3087-2 #2182

Merged

Djelibeybi mentioned this issue Sep 28, 2016

Updated Oracle Linux for OpenSSL CVEs #2203

Merged

tianon closed this as completed Feb 14, 2017

yosifkit mentioned this issue Nov 1, 2019

chore: Add initial SECURITY.md nodejs/docker-node#1144

Merged

yosifkit mentioned this issue Dec 31, 2019

clair scan reveal multiple vulnerabilities nginxinc/docker-nginx#382

Closed

This was referenced Feb 4, 2020

Tags updated daily?? docker-library/ruby#307

Closed

CVE-2019-18224 vulnerability in debian:buster-slim debuerreotype/docker-debian-artifacts#85

Closed

yosifkit mentioned this issue Mar 27, 2020

[nats] Release v2.1.4 #7379

Merged

yosifkit mentioned this issue Apr 22, 2020

please release an Alpine image with libssl 1.1.1g as per CVE-2020-1967 docker-library/haproxy#112

Closed

yosifkit mentioned this issue May 13, 2020

CVE-2020-11655 - sqlite vulnerability being detected via trivy docker-library/php#1016

Closed

yosifkit mentioned this issue Sep 14, 2020

Best practices for following base image updates docker-library/faq#16

Closed

yosifkit mentioned this issue Oct 12, 2020

General question on package update tianon/docker-brew-ubuntu-core#188

Closed

yosifkit mentioned this issue Feb 22, 2021

CVE-2021-23840 still in recent Debian Buster based Python images docker-library/python#580

Closed

This was referenced Aug 25, 2021

Update amazoncorretto #10787

Closed

eclipse-mosquitto 2.0.12 #10826

Merged

This was referenced Sep 9, 2021

Add OpenJDK + Eclipse OpenJ9 images from IBM Semeru Runtimes #10666

Merged

bump Kong to 2.5.1 #10910

Merged

This comment was marked as off-topic.

Sign in to view

This comment was marked as resolved.

Sign in to view

yosifkit mentioned this issue Nov 18, 2022

[percona] update product versions #13081

Merged

yosifkit mentioned this issue Apr 14, 2023

Questions about official image vulnerabilities and scan cycles docker-library/faq#28

Closed

This was referenced Jun 7, 2023

feat(Security): Upgrade alpine packages at build time nginxinc/docker-nginx#797

Closed

Release schedule for Debian security upgrades #14813

Closed

tianon mentioned this issue Jun 20, 2023

Ubuntu 22.04 docker-library/rabbitmq#643

Closed

yosifkit mentioned this issue Aug 5, 2023

[nats] Release v2.9.21 #15148

Merged

tianon mentioned this issue Feb 1, 2024

Base image rebuild questions #16164

Closed

yosifkit mentioned this issue May 2, 2024

Initial commitment of clickhouse official image #15846

Merged

10 tasks

yosifkit mentioned this issue Aug 8, 2024

Update ELK Images #17325

Merged

yosifkit mentioned this issue Sep 19, 2024

add "apt-get upgrade" to get security updates Raku/docker#68

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

openssl: CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2016-6305, CVE-2016-6306, CVE-2016-6307, CVE-2016-6308 #2171

openssl: CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2016-6305, CVE-2016-6306, CVE-2016-6307, CVE-2016-6308 #2171

tianon commented Sep 22, 2016 •

edited by yosifkit

Loading

tianon commented Sep 22, 2016

bryteise commented Sep 22, 2016

tianon commented Sep 22, 2016

tianon commented Sep 22, 2016

tianon commented Sep 22, 2016

tianon commented Sep 26, 2016

tianon commented Sep 26, 2016 •

edited

Loading

tianon commented Feb 14, 2017

This comment was marked as off-topic.

This comment was marked as resolved.

openssl: CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2016-6305, CVE-2016-6306, CVE-2016-6307, CVE-2016-6308 #2171

openssl: CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2016-6305, CVE-2016-6306, CVE-2016-6307, CVE-2016-6308 #2171

Comments

tianon commented Sep 22, 2016 • edited by yosifkit Loading

CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2016-6305, CVE-2016-6306, CVE-2016-6307, CVE-2016-6308

https://www.openssl.org/news/secadv/20160922.txt

tianon commented Sep 22, 2016

bryteise commented Sep 22, 2016

tianon commented Sep 22, 2016

tianon commented Sep 22, 2016

tianon commented Sep 22, 2016

tianon commented Sep 26, 2016

tianon commented Sep 26, 2016 • edited Loading

tianon commented Feb 14, 2017

This comment was marked as off-topic.

This comment was marked as resolved.

tianon commented Sep 22, 2016 •

edited by yosifkit

Loading

tianon commented Sep 26, 2016 •

edited

Loading