golang and OpenSSL vulnerabilities detected in ld-relay:7.2.5 and ld-relay:7.3.1

[fredericdesroches]

golang and OpenSSL vulnerabilities detected in ld-relay:7.2.5 and ld-relay:7.3.1

[louis-launchdarkly]

Hello @fredericdesroches, Alpine just released the latest image 3.18.3 today https://github.com/alpinelinux/docker-alpine/blob/1ff397d1b9e6872e19adc93d6ede0cb638a2418a/x86_64/Dockerfile, and I have a prepared bump for Go versions. We will release once we are able to build and verify the latest ld-relay image.

[fredericdesroches]

Hi @louis-launchdarkly, thank you for the quick update. v7.3.2 fixes most of the issue except CVE-2023-3817. I believe it is ok because CVE-2023-3817 doesn't appear to be "official" yet as it is "undergoing analysis and not all information is available"

If a fix is available any time soon, we will open another gh issue as we are tracking it internally.

I would consider this issue done.

Thanks again!

[louis-launchdarkly]

You are welcome. If CVE-2023-3817 becomes a real issue, the process would be the same - we will wait for Alpine to release a newer image and bump. Just to reassure you, Relay Proxy itself does not use OpenSSL, so the risk of using the ld-relay docker image will be low.

Fixed in 7.3.2.