In this month’s post, we dive into the critical role Chainguard’s CVE remediation team plays in timely patching in maintaining the security of Chainguard Images.
TL;DR
- Last month, Chainguard distributed patches for a total of 998 vulnerabilities
- We issued patches on upstream vulnerabilities for 756 Chainguard Images and 389 Wolfi Packages. All of which are now resolved.
- Chainguard distributes patched images on an average of 26 hours
- Chainguard distributes remediation for 32 vulnerabilities a day on average
Chainguard’s philosophy to CVEs:
The philosophy behind the way Chainguard approaches CVE handling focuses on ensuring accurate and quiet CVE scanner reports for our customers. We want to bring peace of mind to them so this process could well be called ZenPatch Flow or ZenSecure Patching 😂. Either way, it always involves detecting CVEs in packages and images, and choosing the best approach to prevent customers from being alerted by those CVEs in their scans.
In more practical terms, it involves a myriad of tactics and different approaches, ranging from updating packages to cherry-picking surgical fixes, with varying levels of difficulty and value to customers. False-positives are identified and marked, and CVEs are resolved whenever possible. The goal is to achieve Inbox Zero for customers by providing accurate CVE information and minimizing noisy scanner results.
Spotlight: CVE-2024-4603 affecting OpenSSL
Summary
This vulnerability affects applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() in OpenSSL to check DSA public keys or DSA parameters. It can lead to long delays and potentially cause Denial of Service (DoS) attacks when the key or parameters being checked are obtained from an untrusted source.
Context and impact
The issue lies in the fact that the key and parameter check functions in OpenSSL do not limit the modulus size when performing the checks. If an excessively large modulus is supplied, the computations can take a long time, leading to DoS vulnerabilities. This issue affects OpenSSL 3.0 and 3.1 FIPS providers, as well as applications that directly call these functions with untrusted DSA keys. The OpenSSL pkey and pkeyparam command line applications are also vulnerable when using the `-check` option.
Disclosure and response
CVE-2024-4603 was disclosed on May 16th by the OpenSSL Software Foundation. Chainguard's automated processes for distributing patched software quickly addressed the issue, reducing the window of vulnerability for our clients and minimizing the noise in their security scanners. This rapid response detailed below demonstrates Chainguard's commitment to being the fastest distributor of patched open source software.
Mitigation
![Image showing patch for CVE-2024-4603 and epoch bump to 8.](https://cdn.prod.website-files.com/6228fdbc6c971401d02a9c42/66797cbf6ba01687f35e00a9_AD_4nXfJoVrutHOfyyPblZ1Obfdj8cLMwIVxhMPRm4UYQ9R2OhIOKrWlsSah5A-TzNEEqb-NzUU9PLR8Qm6yLluqw-R2DHGpUwWgw7Tp80MVtBXDmvp3bKJjKgGhShVX7we2DEvMcs0eqBJ4gaJ-ebopnpq_g4sG.png)
By addressing this vulnerability in less than two hours, and efficiently propagating patched software throughout the Chainguard’s registry, Chainguard reinforces its dedication to maintaining the security and integrity of our customers’ supply chains.
![Image showing comment from ajayk: "Pick ups the commits from openssl/openssl@53ea064."](https://cdn.prod.website-files.com/6228fdbc6c971401d02a9c42/66797d174843c3e0b816a359_AD_4nXd4JkvHbLThFeMkypefp7h45eEPEPorCTj6ygHzhiPq1HHFfmssJKsp74llxKyXaDMMSAIhfJtw5FYd0TMU83tb8DhHJH73q1c8r6aG-qkUYBfEJr1_iriqd3NChMC2ro_ZhrqSZ7jN0-yx69qrAr5lLyyR.png)
![Image showing approval of aforementioned comment by ajayk less than two hours later.](https://cdn.prod.website-files.com/6228fdbc6c971401d02a9c42/66797d22111b8024fd787597_AD_4nXcR8_jHfr7CXbbE73UnHDVzADA3N9J81_XlaONYPUHWaDjjf6kDXmvYGMAG04vVLiOKWsOlD6yNn87K1TRZS8WW7j3y19xBQi0EIx9h5u9mP626S2OI49pamOp4GiAvscFLW0DGUWqBtW3sXsHsvA7nbF0O.png)
Conclusion
This month's patch report underscores the crucial role of staying informed about new CVEs and applying patches promptly to safeguard software supply chains. These 998 vulnerabilities affecting 756 Chainguard Images and 389 Wolfi Packages, give a sense of the scale of the problem we are solving for our clients. With the automation and manual checks we’ve built in the Chainguard Image’s underlying toolchain, Chainguard takes a significant step towards enhancing our client’s security posture. Contact us if you want to learn how Chainguard Images can help reduce your CVE counts.