Update OpenSSL to 3.5.8 in SPDK base Dockerfile to fix CVE-2026-14456 - #63
Merged
Conversation
Grype's daily security scan of the ultra repo's built image flagged openssl 3.5.7 (baked into simplyblock/spdk-core:nvmf-blocking-from-base-latest via this Dockerfile) for CVE-2026-14456, fixed in 3.5.8/3.6.4/4.0.2. Bump the source build to 3.5.8, same pattern as the prior 3.5.6 -> 3.5.7 bump (d090dff).
mxsrc
approved these changes
Aug 20, 2026
mxsrc
self-requested a review
August 20, 2026 12:33
mxsrc
requested changes
Aug 20, 2026
mxsrc
left a comment
mxsrc
left a comment
There was a problem hiding this comment.
Could you introduce a quick argument for the Version? Avoids missing occurences in the future.
The version string was repeated 4 times in the build RUN command, making it easy to miss an occurrence on future CVE bumps. Centralize it as ARG OPENSSL_VERSION at the top of the builder stage.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
openssl 3.5.7, fixed in 3.5.8/3.6.4/4.0.2, asCVE-2026-14456(High).docker/Dockerfile_spdk_base, which is used to producesimplyblock/spdk-core:nvmf-blocking-from-base-latest— the base image theultrarepo'sDockerfile_spdk_ultrabuilds from.Test plan
docker-base-image-builder-amd.yml/-arm.yml) runs and publishes updatednvmf-blocking-from-base-latestultrarepo's Security Scan workflow passes against the new base image