Questions & Help>Questions

Critical OpenSSL update: will we be covered if we update our underlying OS version of OpenSSL?

#security
lawik

lawik

Nerves Core Team

Critical OpenSSL update: will we be covered if we update our underlying OS version of OpenSSL?

Elixir uses OpenSSL through Erlang. I don’t know the details of how that is handled very well.
I imagine we are exposed to this undisclosed issue.

Will we be covered if we update our underlying OS version of OpenSSL and rebuild Erlang or are we dependent on an Erlang/OTP update?
I’d imagine the Hex Docker images need an update for example.

I’d rather stay on top of it in case it is another Heartbleed.

5 comments
#security
17 1483 5

Marked As Solved

hauleth

hauleth

https://mta.openssl.org/pipermail/openssl-announce/2022-November/000241.html

Seems like non an issue for Erlang applications that use public_key application for cert validation and verification.

2
Post #6

Also Liked

dancwilliams

dancwilliams

The vulnerability only affects OpenSSL Version 3.0.0 - 3.0.6 and most installations are still using the maintained OpenSSL 1.1 code train. Very few base OSs are running OpenSSL 3 by default such as Ubuntu 22 and RHEL 9.x. So any images based on those MAY need to be recreated, but that would depend on how the maintainer has the container built and if they are utilizing OpenSSL 3.

It looks like OTP just gained full production compatibility with OpenSSL 3 in the latest 25.1 release [release notes]. It requires a minimum of OpenSSL 0.9.8 and it looks like Brew is pinned to use OpenSSL 1.1.1.

Hope that helps.

4
Post #3
hauleth

hauleth

AFAIK Erlang uses OpenSSL only for ptimitives and I highly doubt that this problem is related to crypto primitives. My bet is that it is related to TLS layer in which case it is not an issue for Erlang.

3
Post #2
AstonJ

AstonJ

For anyone who wants to check which version is installed on your server you can connect via SSH and run openssl version.

3
Post #4
lawik

lawik

Nerves Core Team

All helpful responses. I think we have some containers built on Ubuntu so will check those.

1
Post #5

Where Next?

View thread on forum (has 5 responses!)
security
Home Questions & Help>Questions
#security
17 1484 5
Last post

Popular in Questions Top

vonH
Questions & Help>Questions

Why would I choose Elixir as a general purpose programming language?
In asking this question I am more interested about the expressiveness of the language itself and less concerned about the availability of...
#functional-programming#use-cases
65 34758 13
New
JorisKok
Questions & Help>Questions

How is it possible to get 2 million websocket connections when you have 65536 available ports?
I have a server on AWS, and was running a load test using artillery. When looking at the Phoenix dashboard I see the Ports going to 100% ...
/phoenix
20 17308 4
New
openscript
Questions & Help>Questions

How to set up the Elixir SDK in Intellij IDEA with the intellij-elixir plugin?
Hello! Sorry for this astonishing simple question, but I’m really stuck. I try to set up the intellij-elixir plugin, but I don’t know ho...
17 22671 9
New
Trevoke
Questions & Help>Questions

(EXIT) no process: the process is not alive or there's no process currently associated with the given name, possibly because its application isn't started
I have an umbrella app. Some of the apps inside depend on other apps in the umbrella, unsurprisingly. I'm writing a test for one of t...
#otp#umbrella#testing#exunit#errors
26 21431 11
New
dokuzbir
Questions & Help>Questions

How to convert list to string without losing brackets
Hello, I am trying to convert my lists to string without losing brackets.For start i have 3 map. They look like these buyer = %{ id: ...
26 14426 10
New
polypush135
Questions & Help>Questions

Proper use of Task.async?
As many of you may have realized by now (sorry for all the posts here) I’ve been working on a db problem where I’m trying to aggregate a ...
#task
26 15568 8
New
myronmarston
Questions & Help>Questions

Typespecs - best way to spec keyword lists?
The Elixir Typespec docs show the following syntax for keyword lists in typespecs: # ... | [key: type] # keyword lis...
#dialyzer
52 14258 3
New
aadeshere1
Questions & Help>Questions

Write while loop equivalent in elixir
I have a another noob question about loop. Since elixir is immutable, while loop is not directly possible. total = 10 while total != 0 ...
#while#loop
60 28200 36
New
chensan
Questions & Help>Questions

(Postgrex.Error) ERROR 42804 (datatype_mismatch): column "" cannot be cast automatically to type integer
I have a User schema with a :from_id field set to type :string: defmodule TweetBot.Repo.Migrations.CreateUsers do use Ecto.Migration ...
#ecto
29 13294 4
New
baxterw3b
Questions & Help>Questions

Anonymous functions with multiple body
Hi guys, i’m new in the Elixir world, and i have to say, that i love it! i’m having some problem to understand anonymous functions with ...
19 21396 4
New

Other popular topics Top

srinivasu
Questions & Help>Questions

Best Practises for Error handling elixir?
How to handle excepions in elixir? Suppose i have A, B, C ,D, E modules. and each module has get() function. A.get() method will call th...
16 16061 9
New
William
Learning Resources>Chat/questions

Resources for building an e-commerce store in Phoenix?
I would like to know that is there any online source for learning Phoenix Framework for building E-Commerce Store? Any advantage on build...
/phoenix#ecommerce
137 23142 64
New
JorisKok
Questions & Help>Questions

How is it possible to get 2 million websocket connections when you have 65536 available ports?
I have a server on AWS, and was running a load test using artillery. When looking at the Phoenix dashboard I see the Ports going to 100% ...
/phoenix
20 17308 4
New
Trevoke
Questions & Help>Questions

(EXIT) no process: the process is not alive or there's no process currently associated with the given name, possibly because its application isn't started
I have an umbrella app. Some of the apps inside depend on other apps in the umbrella, unsurprisingly. I'm writing a test for one of t...
#otp#umbrella#testing#exunit#errors
26 21431 11
New
fireproofsocks
Questions & Help>Questions

Defining Ecto Schemas (PostGres) to use NOT NULL in column definitions
I’m working on defining a simple Ecto schema for a table (in PostGres), but I don’t see where I can define a column as NOT NULL. Conside...
#ecto
29 14078 4
New
vac
Questions & Help>Questions

Formatting a string to PEM with headers and line breaks
Hi, I'm quite new in Elixir and I'm trying to format a string to a PEM format. I have the certificate value like MIIDBTCCAe2...... and ...
2 14555 7
New
chrismccord
News>Phoenix News

Phoenix v1.3.0-rc.0 released
As promised, the first release candidate of Phoenix 1.3.0 is out! This release focuses on code generators with improved project structure...
/phoenix#phoenix-release
434 29347 97
New
danschultzer
Libraries & Projects>Libraries

Pow: Robust, modular, extendable user authentication and management system
None of the current solutions worked well for me, so I went ahead and built a user management system from scratch. This project took far...
/phoenix#authentication#library#authorization#user_system#pow
548 27727 240
New
aadeshere1
Questions & Help>Questions

Write while loop equivalent in elixir
I have a another noob question about loop. Since elixir is immutable, while loop is not directly possible. total = 10 while total != 0 ...
#while#loop
60 28200 36
New
fireproofsocks
Questions & Help>Questions

Ecto delete a record WITHOUT selecting first
Forgive me if this is obvious, but how does one delete a database record WITHOUT selecting it first? https://hexdocs.pm/ecto/Ecto.Repo.h...
#ecto#optimization#delete-method
22 16810 8
New
Back to top

Questions & Help>Questions

Questions Questions ❯

Latest on Elixir Forum

Elixir Forum ❯

Sponsor Spotlight

Dashbit

Build Elixir applications with speed and confidence.

Our Sponsors

Dashbit

Build Elixir applications with speed and confidence.

EEF

Supporting innovation across the BEAM ecosystem.

Coders51

We build reliable cloud platforms for business-critical systems.

AppSignal

Catch errors, track performance, monitor hosts and more.

ElixirCasts

Producing high quality Elixir screencasts since 2017.

WyewWorks

Enabling companies to succeed by building software people love.

Potions

The deployment platform built for Elixir: PaaS ease, VPS control.

Pragmatic Studio

Courses that'll move you from confusion to "Aha, now I get it!"

View all our sponsors ❯

Categories:

Sub Categories:

Forums

Our Sponsors

Dashbit

Build Elixir applications with speed and confidence.

EEF

Supporting innovation across the BEAM ecosystem.

Coders51

We build reliable cloud platforms for business-critical systems.

AppSignal

Catch errors, track performance, monitor hosts and more.

ElixirCasts

Producing high quality Elixir screencasts since 2017.

WyewWorks

Enabling companies to succeed by building software people love.

Potions

The deployment platform built for Elixir: PaaS ease, VPS control.

Pragmatic Studio

Courses that'll move you from confusion to "Aha, now I get it!"

View all our sponsors ❯

We're in Beta

About us Mission Statement