Pact Foundation

Hi Everyone,
      I was trying to find out if there is an open issue to patch OpenSSL vulnerability. Particularly the Pact-Broker Dockerfile using Alpine 3.15 below. Please let me know if this is not the right forum to post this question and direct me to the right direction.
Thank you,
Matthew
<https://github.com/pact-foundation/pact_broker/blob/88b7df42ea593c20315d06a0206795ccaaf752a3/Dockerfile#L1>

docker image vulnerability page: <https://dso.docker.com/cve/DSA-2022-0001>
CVE <https://dso.docker.com/cve/CVE-2022-3602>

Hey,

have you checked the repo? that is where issues would be tend to be reported for visibility and action.

You can also fork the repository and provide a patch easily once tested.

Gotcha. Yes I was looking through the repo-&gt;issues and I didn’t see any issue related to the OpenSSL vulnerability.

<https://github.com/pact-foundation/pact_broker/issues>

And searching through Pact Foundation slack didn’t yield any results.

Would the best thing to do is to report the issue in the repo and try forking it to see if I can patch it?

I can put out a new release as soon as the PR is done.

I can see that here was a push to `2.7.6-alpine3.15` 8 days ago, so it’s possible that it’s been fixed in the base image already.

I’ve kicked off the release workflow - that may just be all we need to do.

<https://hub.docker.com/layers/pactfoundation/pact-broker/2.105.0.1/images/sha256-37ddf51838eabb5ca4b435e91d002737b7dca98c5bf7c9190848a7f173a81938?context=repo|2.105.0.1> is out now. It passed trivy scan, so I assume it has the ssl fix in it

Alpine did patched it:
<https://gitlab.alpinelinux.org/alpine/aports/-/commit/4d2c24afe59165b61cb6eee526845ef6f1b17714|main/openssl3: upgrade to 3.0.7 (CVE-2022-3602, CVE-2022-3786)>

And I pull in the latest image <https://hub.docker.com/layers/pactfoundation/pact-broker/2.105.0.1/images/sha256-37ddf51838eabb5ca4b435e91d002737b7dca98c5bf7c9190848a7f173a81938?context=repo|2.105.0.1> and see that alpine version was 3.16.2 so I think it’s fixed.
`/ # cat /etc/os-release`
`NAME="Alpine Linux"`
`ID=alpine`
`VERSION_ID=3.16.2`
`PRETTY_NAME="Alpine Linux v3.16"`

Thanks for checking this <@U02FFKFGNTY>

I noted the pact-broker-docker repo doesn't have a security readme. <https://github.com/pact-foundation/pact-broker-docker>

do you think that would have helped you for guidance in how go about reporting, and potentially resolving

<https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository>


&gt; Would the best thing to do is to report the issue in the repo and try forking it to see if I can patch it?
Also to echo <@UAPSFV5QV> encouragement, this is the literally the dream for any open source project/maintainers

Yes, I think that would help in guiding me how to approach this. I did the usual search in the repo and issues to find anything related to the vulnerability and also a lot googling. I just didn’t know what the next after that so I post the question here.