bugGNU Octave - Bugs: bug #63876, [MXE Octave] OpenSSL vulnerability

 
 

bug #63876: [MXE Octave] OpenSSL vulnerability

Submitter:  None
Submitted:  Tue 07 Mar 2023 12:30:39 PM UTC
   
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  Fixed Assigned to:  None
Originator Name:  C Hay Originator Email:  -email is unavailable-
Open/Closed:  * Closed Release:  * 7.3.0
Release:  Operating System:  * Microsoft Windows
Fixed Release:  8.1.0 Planned Release:  8.1.0
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Thu 09 Mar 2023 10:41:58 AM UTC, comment #9: 

I don't know what exactly pulls in openssl as a dependency. It might be pacman (via some other packages)?

Anyway, I don't know if you can delete it. Do you have the necessary permissions? If you do, you'll probably find out if something starts failing for you.

Anyway, all of this is starting to appear very theoretical if the only aim you have is trying to appease some third-party tool...

Markus Mützel <mmuetzel>
Group administrator
Thu 09 Mar 2023 10:12:01 AM UTC, comment #8: 

I'm not using openssl.exe for any of my own purposes. I assumed Octave must use it for connecting to certain internet resources or something. Though having a closer look at the folder structure of an Octave install on Windows it looks very like the folder structure of a full Linux OS. Is the Windows distribution of Octave really some kind of full Linux distribution and openssl.exe isn't actually needed?

In any case, can I just delete openssl.exe from my install? My whole line of questioning is because a vulnerability scanner picking up a binary (openssl.exe) with known critical CVEs.

Anonymous
Wed 08 Mar 2023 11:14:16 AM UTC, comment #7: 

Btw, for what are you using the openssl.exe from the Octave installation?

Markus Mützel <mmuetzel>
Group administrator
Wed 08 Mar 2023 11:10:44 AM UTC, comment #6: 

Windows can be a bit tricky at times when it comes to mixing libraries from different toolchains and different run-time environments.
Octave for Windows is built with a MinGW toolchain linking against MSVCRT. IIUC, modern MSVC links against UCRT.

The binaries in usr/bin are from MSYS2. If you replace a binary in that folder, you should probably use one that is a Cygwin binary (linking to the same Cygwin heap from MSYS2).
If you update with the version from MSYS2 (not any of the native binaries that they also distribute), it would probably work.

I haven't tested that. But maybe it would update with the following commands in the cmdshell:

pacman -Sy
pacman -S openssl


(Don't run `pacman -Su` because that would likely mess up the binaries in the "mingw64" folder...)

Markus Mützel <mmuetzel>
Group administrator
Wed 08 Mar 2023 10:12:06 AM UTC, comment #5: 

I have installed Octave 8.1 and the version of OpenSSL it uses (3.0.7) also has a critical CVE:

CVE-2022-4203

https://nvd.nist.gov/vuln/detail/CVE-2022-4203

Advisory from OpenSSL is in here:
https://www.openssl.org/news/secadv/20230207.txt

Is there any issue with manually patching by simply dropping a new openssl.exe replacement (OpenSSL 3.0.8) at:
GNU Octave\Octave-8.1.0\usr\bin\openssl.exe

Should I open a new bug for this?

Anonymous
Tue 07 Mar 2023 10:45:29 PM UTC, comment #4: 

( it is octave 8.1.0 )

Dmitri A. Sergatskov <dasergatskov>
Tue 07 Mar 2023 10:44:33 PM UTC, comment #3: 

Octave 8.1.1 has been just released:

https://ftp.gnu.org/gnu/octave/windows/

Dmitri.
--


Dmitri A. Sergatskov <dasergatskov>
Tue 07 Mar 2023 12:59:55 PM UTC, comment #2: 

comment #1:

> The version of OpenSSL that will be included in the next Octave for Windows installer is the one from here:
> https://hg.octave.org/mxe-octave/file/release/src/msys2-libopenssl.mk
>
> That will be version 3.0.7.
>
> IIUC, that version is not affected by that CVE.
>
> Closing as already fixed.
>


Thank you for clarifying this. Is there a release date for version 8 or roadmap for future versions?

Anonymous
Tue 07 Mar 2023 12:50:52 PM UTC, comment #1: 

The version of OpenSSL that will be included in the next Octave for Windows installer is the one from here:
https://hg.octave.org/mxe-octave/file/release/src/msys2-libopenssl.mk

That will be version 3.0.7.

IIUC, that version is not affected by that CVE.

Closing as already fixed.

Markus Mützel <mmuetzel>
Group administrator
Tue 07 Mar 2023 12:30:39 PM UTC, original submission:  

The version of OpenSSL used with Octave 7.3.0 contains a critical vulnerability (Security Vulnerability CVE-2021-3711 for OpenSSL).

Can the version of OpenSSL bundled with Octave be updated in a future release? (Fixed in OpenSSL 1.1.1l Affected since 1.1.1)
From: https://www.openssl.org/news/vulnerabilities.html

This has only been tested in the Windows install.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by dasergatskov (Posted a comment)
  • -email is unavailable- added by mmuetzel (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-03-07 mmuetzel StatusNone Fixed
        Open/ClosedOpen Closed
        Fixed ReleaseNone 8.1.0
        Planned ReleaseNone 8.1.0
        SummaryOpenSSL vulnerability [MXE Octave] OpenSSL vulnerability

    Back to the top

    Powered by Savane 3.15-e6e5.
    Corresponding source code