Bump embedded OpenSSL to 3.5.8 (CVE-2026-14456) - #498
Merged
Conversation
OpenSSL 3.5.8 was released on 2026-08-25 and fixes CVE-2026-14456 (unbounded memory growth in the QUIC server incoming channel queue), which the dev chart scan reports as HIGH against the embedded 3.5.7. When the finding was first triaged the advertised fixed versions were unreleased advisory placeholders; 3.5.8 now exists, so this is a same-line patch bump rather than an exception decision. The pin lives in three coordinated places and diverging them would build one version while reporting another, so all three move together. The dd-agent-omnibus S3 mirror does not carry 3.5.7 or 3.5.8, so the openssl.org fallback is what actually serves the download. Validated by building @openssl//:openssl from the new pin: the archive checksum matches openssl.org's published sha256, patch 0001 still applies, and the resulting library reports 3.5.8. Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
The exception existed only because no fixed OpenSSL release had shipped, and its own renewal note says to bump instead as soon as one did. With 3.5.8 pinned the finding is gone, so keeping the entry would assert a no-upstream-fix status that is no longer true and would suppress the advisory if it ever reappeared for a different reason. Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
The note explains why patch 0002 is absent; naming 3.5.7 as the version that carries the fix upstream makes it read as the current pin, which this branch has already moved past. Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
Author
|
Green on The two earlier red DEB runs were not caused by this change:
The third commit fixes a comment this bump makes stale; pushing it also moved CI onto a merge with the current base Re-verified on that base: 3.5.8 tarball sha256 matches openssl.org, patch 0001 applies, the built library reports 3.5.8, and an agent image with those libraries keeps |
LouisLotter
approved these changes
Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the embedded OpenSSL from 3.5.7 to 3.5.8, which upstream released on 2026-08-25 with the fix for
CVE-2026-14456(HIGH). The earlier triage concluded there was nothing to bump because the advertised fixed versions were unreleased advisory placeholders — that is no longer true, so this replaces the exception with the actual patch.The pin lives in three coordinated places (
deps/openssl/version.bzl,deps/repos.MODULE.bazel,omnibus/config/software/openssl3.rb); diverging them builds one version and reports another.exceptions/stackstate-k8s-agent/CVE-2026-14456.yamlis removed in its own commit since its stated no-upstream-fix reason no longer holds.Reviewer note: the
dd-agent-omnibusS3 mirror carries neither 3.5.7 nor 3.5.8, so thewww.openssl.orgfallback is what actually serves this download — worth confirming that is acceptable rather than mirroring 3.5.8 first.Coordination ticket: https://github.com/StackVista/cve-reporter/issues/29
Repo ticket: #489
Finding revision:
sha256:d5bbd460908f388b90292d63a0734d20df10b892c7a0ae198d88d26b14184414Validation:
@openssl//:opensslbuilds from the new pin (checksum matches openssl.org's published sha256, patch 0001 applies, library reports 3.5.8); a representative agent image built on top ofd8cd29dbwith the rebuilt libs passesagent version, embedded-Pythonssl(reports 3.5.8, TLS context OK) and cipher/digest parity with the base image. Grype on that image clearsCVE-2026-14456with no new findings; Trivy vulnerability and a separate Trivy secret scan are unchanged (0 secrets). The fivepython 3.13.15mediums are untouched — 3.13.15 is the newest 3.13.x, so no compatible patch exists for them yet.