Skip to content

Upgrade openssl and krb5 to latest debian version #71

Draft
liuh-80 wants to merge 15 commits intosonic-net:mainfrom
liuh-80:dev/liuh/upgrade_version
Draft

Upgrade openssl and krb5 to latest debian version #71
liuh-80 wants to merge 15 commits intosonic-net:mainfrom
liuh-80:dev/liuh/upgrade_version

Conversation

@liuh-80
Copy link
Contributor

@liuh-80 liuh-80 commented Jan 21, 2025

Upgrade openssl and krb5 to latest debian version:

openssl-3.0.15-1~deb12u1
libk5crypto3-1.20.1-2+deb12u2

Why I did it

Currently there are following issue:

  1. Debian package will release new version every 1-2 month, when that happen, the SONiC image will use the latest Debian package, the fips feature will broken.
  2. On Debian package website, there is no commit ID for debian package, only an archive file of source code. it's difficult to find out the commit ID by that archive file and update submodule of this repo with commit ID, a mismatch commit ID may cause compatibility issue and security issue. an example is 'libk5crypto3-1.20.1-2+deb12u2', in the git repo, there is no 'debian/krb5-1.20.1-2+deb12u2' tag. there are 2 urgent security patches only exist in the archive file:

krb5 (1.20.1-2+deb12u2) bookworm-security; urgency=high

  • CVE-2024-37370: an unauthenticated attacker can modify the
    extra count in an RFC 4121 GSS token, causing the token to appear
    truncated.
  • CVE-2024-37371: an attacker can cause invalid memory reads by
    sending an invalid GSS token.
Work item tracking
  • Microsoft ADO: 30945454

How I did it

Upgrade openssl and krb5 to latest version
Download and build openssl and krb5 based on latest debian patched code

How to verify it

Pass all UT.

Which release branch to backport (provide reason below if selected)

  • 201811
  • 201911
  • 202006
  • 202012
  • 202106
  • 202111
  • 202205
  • 202211
  • 202305

Tested branch (Please provide the tested image version)

  • []

Description for the changelog

Upgrade openssl and krb5 to latest debian version

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

@mssonicbld
Copy link

/azp run

@liuh-80 liuh-80 force-pushed the dev/liuh/upgrade_version branch from c6a6ad9 to 582bbd1 Compare January 21, 2025 11:02
@mssonicbld
Copy link

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@liuh-80
Copy link
Contributor Author

liuh-80 commented Jan 23, 2025

PR merge validation failed because some test failed, verify the test failed not cause by code change with another PR:#72

@mssonicbld
Copy link

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants