You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by "tetrate-ci (via GitHub)" <gi...@apache.org> on 2026/06/12 00:15:32 UTC
[PR] cves: bump libssl3 and libcrypto3 to 3.5.7-r0 to fix openssl CVEs [skywalking-satellite]
tetrate-ci opened a new pull request, #262:
URL: https://github.com/apache/skywalking-satellite/pull/262
## CVEs Fixed
| CVE | Severity | Package | Fix |
|-----|----------|---------|-----|
| CVE-2026-34183 | MEDIUM | libssl3, libcrypto3 | Bumped to >=3.5.7-r0 |
| CVE-2026-42769 | LOW | libssl3, libcrypto3 | Bumped to >=3.5.7-r0 |
| CVE-2026-34181 | LOW | libssl3, libcrypto3 | Bumped to >=3.5.7-r0 |
| CVE-2026-42768 | LOW | libssl3, libcrypto3 | Bumped to >=3.5.7-r0 |
These CVEs affect openssl/libssl3/libcrypto3 packages in Alpine 3.23. Fixed by bumping minimum version from 3.3.7-r0 to 3.5.7-r0.
/cc @kezhenxu94
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cves: bump libssl3 and libcrypto3 to 3.5.7-r0 to fix openssl CVEs [skywalking-satellite]
Posted by "kezhenxu94 (via GitHub)" <gi...@apache.org>.
kezhenxu94 merged PR #262:
URL: https://github.com/apache/skywalking-satellite/pull/262
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cves: bump libssl3 and libcrypto3 to 3.5.7-r0 to fix openssl CVEs [skywalking-satellite]
Posted by "tetrate-ci (via GitHub)" <gi...@apache.org>.
tetrate-ci commented on PR #262:
URL: https://github.com/apache/skywalking-satellite/pull/262#issuecomment-4689076328
Hi @kezhenxu94 — all 30 CI checks are ✅ green. Could you please review and merge this PR? It's a security fix bumping `libssl3` and `libcrypto3` to `>=3.5.7-r0` to fix CVE-2026-34183, CVE-2026-42769, CVE-2026-34181, CVE-2026-42768. Thank you\!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cves: bump libssl3 and libcrypto3 to 3.5.7-r0 to fix openssl CVEs [skywalking-satellite]
Posted by "tetrate-ci (via GitHub)" <gi...@apache.org>.
tetrate-ci commented on PR #262:
URL: https://github.com/apache/skywalking-satellite/pull/262#issuecomment-4686435039
Hi @kezhenxu94, could you please review and merge this PR?
The `Istio(1.27.0)+MetricsService` CI failure is a known pre-existing flaky test (the same test also fails on main branch runs unrelated to this PR — the OAP helm install times out). Our change only bumps the minimum version constraint for libssl3 and libcrypto3 in the Docker image, which has no impact on the Istio E2E tests.
All other CI checks (Build, Test, E2E for other Istio versions) passed. Thank you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cves: bump libssl3 and libcrypto3 to 3.5.7-r0 to fix openssl CVEs [skywalking-satellite]
Posted by "tetrate-ci (via GitHub)" <gi...@apache.org>.
tetrate-ci commented on PR #262:
URL: https://github.com/apache/skywalking-satellite/pull/262#issuecomment-4688021358
Hi @kezhenxu94 — all 30 CI checks are passing ✅. Could you please review and merge this PR? This is a security fix bumping `libssl3` and `libcrypto3` to `>=3.5.7-r0` to remediate CVE-2026-34183, CVE-2026-42769, CVE-2026-34181, and CVE-2026-42768 (openssl/Alpine). Thank you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cves: bump libssl3 and libcrypto3 to 3.5.7-r0 to fix openssl CVEs [skywalking-satellite]
Posted by "tetrate-ci (via GitHub)" <gi...@apache.org>.
tetrate-ci commented on PR #262:
URL: https://github.com/apache/skywalking-satellite/pull/262#issuecomment-4690752781
Friendly ping @kezhenxu94 — this PR has been waiting for ~10 hours. All 30 CI checks are ✅ green. It's a 1-line Dockerfile security fix bumping `libssl3` and `libcrypto3` to `>=3.5.7-r0` to address CVE-2026-34183, CVE-2026-42769, CVE-2026-34181, CVE-2026-42768 (OpenSSL HIGH severity). The downstream monorepo PR [tetrateio/tetrate#30986](https://github.com/tetrateio/tetrate/pull/30986) is blocked until this merges. Thank you\!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org