Update outdated OpenSSL version in build images

[Jakuje]

We got recently an oss-fuzz report for libssh that is pointing deep into the openssl code, which is far from reach of our project. Looking into the traces, the openssl-1.0.2g is used, which is after EOL so I do not believe it is something we should be solving and debugging.

The openssl is installed in the base-runner image already. Would it make sense to update to something more up-to-date?

The oss-fuzz reports showing the openssl issues:
https://oss-fuzz.com/testcase-detail/5152650317529088
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22133

[jonathanmetzman]

I'm assuming that the base builder image has an old openssl regardless of what sanitizer build is being done (for sanitizer builds @oliverchang does some magic to build dependencies with MSAN).
I'm not sure we should to fix this besides doing #3756 since there are probably many dependencies installed via apt that are out-of-date.

[oliverchang]

I'm assuming that the base builder image has an old openssl regardless of what sanitizer build is being done (for sanitizer builds @oliverchang does some magic to build dependencies with MSAN).

Right, MSan builds are also at the exact same version as what apt has.

I'm not sure we should to fix this besides doing #3756 since there are probably many dependencies installed via apt that are out-of-date.

+1

[Jakuje]

@jonathanmetzman Any update on this? Looks like the fuzzer is bumping into this issue more frequently than needed so it already escalated to the Fuzz-Blocker:

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22133#c7

[jonathanmetzman]

@Jakuje I don't know we can fix it so easily. We provide ubuntu 16.04 images. I'm not sure the correct thing to do is to update libraries that are old. I think this can be confusing for projects that expect certain settings on Ubuntu 16.04.
Maybe you can build your project with a newer OpenSSL version.
The only real option for us at this point is to update to a newer ubuntu version. We haven't done this yet and don't have nearterm plans to do it, but we will need to do it eventually.

[DavidKorczynski]

@Jakuje - I did a fix here #6256 which compiles libssh from source and uses the compiled version. We can merge this in for now and then update once base images are upgraded. Please let me know in the PR if you are happy with that.

[jonathanmetzman]

Is this still necessary now that #6180 is complete? Ubuntu 20.04 comes with libssl1.1

[Jakuje]

When you update to 20.04, it will be just 1.5 year old stuff in the image, which should be good enough for some time. The OpenSSL 1.1.1 should be supported at least until 2023 (assuming the bugs will be updated also in the image) [1].

[1] https://www.openssl.org/source/

[DavidKorczynski]

When you update to 20.04, it will be just 1.5 year old stuff in the image, which should be good enough for some time. The OpenSSL 1.1.1 should be supported at least until 2023 (assuming the bugs will be updated also in the image) [1].

[1] https://www.openssl.org/source/

The base image is now Ubuntu 20.04:

oss-fuzz/infra/base-images/base-image/Dockerfile

Line 19 in 2f433a1

FROM ubuntu:20.04

I think this can be closed.

[DavidKorczynski]

Closing this as the OSS-Fuzz base image is now Ubuntu 20.04 - for more details see here #6302