Questions & Help>Questions

Critical OpenSSL update: will we be covered if we update our underlying OS version of OpenSSL?

#security
lawik

lawik

Nerves Core Team

Critical OpenSSL update: will we be covered if we update our underlying OS version of OpenSSL?

Elixir uses OpenSSL through Erlang. I don’t know the details of how that is handled very well.
I imagine we are exposed to this undisclosed issue.

Will we be covered if we update our underlying OS version of OpenSSL and rebuild Erlang or are we dependent on an Erlang/OTP update?
I’d imagine the Hex Docker images need an update for example.

I’d rather stay on top of it in case it is another Heartbleed.

5 comments
#security
17 1483 5

Marked As Solved

hauleth

hauleth

https://mta.openssl.org/pipermail/openssl-announce/2022-November/000241.html

Seems like non an issue for Erlang applications that use public_key application for cert validation and verification.

2
Post #6

Also Liked

dancwilliams

dancwilliams

The vulnerability only affects OpenSSL Version 3.0.0 - 3.0.6 and most installations are still using the maintained OpenSSL 1.1 code train. Very few base OSs are running OpenSSL 3 by default such as Ubuntu 22 and RHEL 9.x. So any images based on those MAY need to be recreated, but that would depend on how the maintainer has the container built and if they are utilizing OpenSSL 3.

It looks like OTP just gained full production compatibility with OpenSSL 3 in the latest 25.1 release [release notes]. It requires a minimum of OpenSSL 0.9.8 and it looks like Brew is pinned to use OpenSSL 1.1.1.

Hope that helps.

4
Post #3
hauleth

hauleth

AFAIK Erlang uses OpenSSL only for ptimitives and I highly doubt that this problem is related to crypto primitives. My bet is that it is related to TLS layer in which case it is not an issue for Erlang.

3
Post #2
AstonJ

AstonJ

For anyone who wants to check which version is installed on your server you can connect via SSH and run openssl version.

3
Post #4
lawik

lawik

Nerves Core Team

All helpful responses. I think we have some containers built on Ubuntu so will check those.

1
Post #5

Where Next?

View thread on forum (has 5 responses!)
security
Home Questions & Help>Questions
#security
17 1484 5
Last post

Popular in Questions Top

bsollish-terakeet
Questions & Help>Questions

Checking if an enum is empty - Credo vs Compiler
Credo is smart enough to check for (something like) this: assert length(the_list) == 0 with this response: Checking if an enum is empt...
#compiler#credo
8 22889 6
New
LegitStack
Questions & Help>Questions

Best way to get Elixir to work with python?
I’m hoping you guys can give me some general advice and perhaps code examples if you’re feeling up to it. I’m very interested in Elixir,...
#python#interoperability
35 13513 9
New
polypush135
Questions & Help>Questions

Proper use of Task.async?
As many of you may have realized by now (sorry for all the posts here) I’ve been working on a db problem where I’m trying to aggregate a ...
#task
26 15568 8
New
chensan
Questions & Help>Questions

(Postgrex.Error) ERROR 42804 (datatype_mismatch): column "" cannot be cast automatically to type integer
I have a User schema with a :from_id field set to type :string: defmodule TweetBot.Repo.Migrations.CreateUsers do use Ecto.Migration ...
#ecto
29 13294 4
New
qwerescape
Questions & Help>Questions

How to get the call stack/stack trace at any point in code?
Is there a way to get the call stack or stack trace at any point in the code? Not from exceptions, but an expression that returns how the...
53 15772 4
New
mathew4509
Questions & Help>Questions

Iterating through a list
I have a list say x = ["23gh", "56kh", "97mh"] I would like to pass each element to Val in each iteration. Say, in iteration 1 -------...
#book-programming-elixir#enumerables#enum#list
3 12090 5
New
kostonstyle
Questions & Help>Questions

Create time with one hour plus
Hi all I want to have a unix time, from the current time plus 1 hour. DateTime.now + 1 hour How to get it in elixir? Thanks
#time
33 13478 5
New
WestKeys
Questions & Help>Questions

Mint vs Finch vs Gun vs Tesla vs HTTPoison etc
Currently suffering from paralysis by [HTTP client] analysis. This is rather unusual in Elixirland as there tends to be consensus on the ...
#http_client
252 21859 30
New
Mooodi
Questions & Help>Questions

Get a char from a string by index
Given a string, how can I get access to its character by index? Enum.at("my_string", 2) doesn't work. Or rather, not char, but a substr...
12 13252 4
New
wernerlaude
Questions & Help>Questions

How to get all entries by user_id
In AR this is so simple @articles = current_user.articles How to do in Ecto? def index(conn, _params) do current_user = conn.assig...
/phoenix#ecto#troubleshooting
4 14281 14
New

Other popular topics Top

minhajuddin
Questions & Help>Questions

Using List.first instead of Enum.at(0)
I have seen a lot of code which picks the first element from a list using Enum.at(0) instead of List.first. Is there a reason why people ...
#code-style
76 33273 14
New
SoCreat
Questions & Help>Questions

What's the best ide/editor for elixir in 2021?
i’m a new one to elixir which editor can i use vs code? or atom? Thanks! :smiley:
#ide
68 37349 27
New
srinivasu
Questions & Help>Questions

Best Practises for Error handling elixir?
How to handle excepions in elixir? Suppose i have A, B, C ,D, E modules. and each module has get() function. A.get() method will call th...
16 16061 9
New
vonH
Questions & Help>Questions

Why would I choose Elixir as a general purpose programming language?
In asking this question I am more interested about the expressiveness of the language itself and less concerned about the availability of...
#functional-programming#use-cases
65 34758 13
New
polypush135
Questions & Help>Questions

Proper use of Task.async?
As many of you may have realized by now (sorry for all the posts here) I’ve been working on a db problem where I’m trying to aggregate a ...
#task
26 15568 8
New
nsuchy
Questions & Help>Questions

IEX in Windows Powershell?
Hi. I’ve noticed that Windows Powershell has it’s own IEX command and you cannot access Elixir’s IEX due to the conflict. This isn’t a cr...
#iex#microsoft-windows#windows#powershell
15 29309 4
New
vertexbuffer
Questions & Help>Questions

Deleting item from a list
Hello, can anybody help here..? I have a list of players and I what to delete an element, but every for loop the list is reverting to ori...
7 24097 4
New
aadeshere1
Questions & Help>Questions

Write while loop equivalent in elixir
I have a another noob question about loop. Since elixir is immutable, while loop is not directly possible. total = 10 while total != 0 ...
#while#loop
60 28200 36
New
qwerescape
Questions & Help>Questions

How to get the call stack/stack trace at any point in code?
Is there a way to get the call stack or stack trace at any point in the code? Not from exceptions, but an expression that returns how the...
53 15772 4
New
Qqwy
Questions & Help>Questions

Updating structs: Map.put vs %Foo{oldfoo | new: value} vs put_in
Original source of discussion: This topic on the Pragmatic Programmers' Functional Web Development with Elixir, OTP, and Phoenix forum. ...
#maps#structs#pipeline#access
115 28410 31
New
Back to top

Questions & Help>Questions

Questions Questions ❯

Latest on Elixir Forum

Elixir Forum ❯

Sponsor Spotlight

WyewWorks

Enabling companies to succeed by building software people love.

Our Sponsors

Dashbit

Build Elixir applications with speed and confidence.

EEF

Supporting innovation across the BEAM ecosystem.

Coders51

We build reliable cloud platforms for business-critical systems.

AppSignal

Catch errors, track performance, monitor hosts and more.

Manning

Develop your skills with books, videos, and courses.

WyewWorks

Enabling companies to succeed by building software people love.

Potions

The deployment platform built for Elixir: PaaS ease, VPS control.

Pragmatic Studio

Courses that'll move you from confusion to "Aha, now I get it!"

View all our sponsors ❯

Categories:

Sub Categories:

Forums

Our Sponsors

Dashbit

Build Elixir applications with speed and confidence.

EEF

Supporting innovation across the BEAM ecosystem.

Coders51

We build reliable cloud platforms for business-critical systems.

AppSignal

Catch errors, track performance, monitor hosts and more.

Manning

Develop your skills with books, videos, and courses.

WyewWorks

Enabling companies to succeed by building software people love.

Potions

The deployment platform built for Elixir: PaaS ease, VPS control.

Pragmatic Studio

Courses that'll move you from confusion to "Aha, now I get it!"

View all our sponsors ❯

We're in Beta

About us Mission Statement