Security Vulnerability: Alpine Linux 3.20, 3.21 - openssl Man-in-the-Middle Vulnerability - 3.3.3-r0
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.6k
- Forks
- 2.4k
- Avg merge
- 53m
- Merged PRs (30d)
- 1
Description
we have found security vulnerability w.r.t open-ssl for NVIDIA/Cuda, kindly have a look and provide the fix
Summary
Inclusion of vulnerable OpenSSL from Alpine base image
Details
TLS and DTLS connections using raw public keys may be vulnerable to man-in-middle attacks when server authentication failure is not detected by clients. RPKs are disabled by default in both TLS clients and TLS servers. Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. [CVE-2024-12797] Vendor Affected Components: Alpine Linux: 3.20 Alpine Linux: 3.21.
Action Required
Upgrade the base Alpine image and ensure OpenSSL is patched.
CVEs:
CVE-2024-12797
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named. Start by locating the Alpine base-image definitions used by the CUDA samples and checking the included OpenSSL version against CVE-2024-12797. Done means the base image is upgraded and the vulnerable OpenSSL version is no longer included.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, linux
- Domain
- infrastructure, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100