From 284b2ce0594b32f883bb31d30363e9f537d28032 Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Thu, 27 Aug 2026 19:56:15 +0000 Subject: [PATCH 1/3] Bump embedded OpenSSL to 3.5.8 for CVE-2026-14456 OpenSSL 3.5.8 was released on 2026-08-25 and fixes CVE-2026-14456 (unbounded memory growth in the QUIC server incoming channel queue), which the dev chart scan reports as HIGH against the embedded 3.5.7. When the finding was first triaged the advertised fixed versions were unreleased advisory placeholders; 3.5.8 now exists, so this is a same-line patch bump rather than an exception decision. The pin lives in three coordinated places and diverging them would build one version while reporting another, so all three move together. The dd-agent-omnibus S3 mirror does not carry 3.5.7 or 3.5.8, so the openssl.org fallback is what actually serves the download. Validated by building @openssl//:openssl from the new pin: the archive checksum matches openssl.org's published sha256, patch 0001 still applies, and the resulting library reports 3.5.8. Co-authored-by: Cve Ticket Reconciler --- deps/openssl/version.bzl | 2 +- deps/repos.MODULE.bazel | 8 ++++---- omnibus/config/software/openssl3.rb | 8 ++++---- .../cve-2026-14456-openssl-3-5-8-4f1a9c2d7b3e6058.yaml | 6 ++++++ 4 files changed, 15 insertions(+), 9 deletions(-) create mode 100644 releasenotes/notes/cve-2026-14456-openssl-3-5-8-4f1a9c2d7b3e6058.yaml diff --git a/deps/openssl/version.bzl b/deps/openssl/version.bzl index 3d566795bae..ad2cee46e68 100644 --- a/deps/openssl/version.bzl +++ b/deps/openssl/version.bzl @@ -1 +1 @@ -OPENSSL_VERSION = "3.5.7" +OPENSSL_VERSION = "3.5.8" diff --git a/deps/repos.MODULE.bazel b/deps/repos.MODULE.bazel index da4aa38b0f0..52c8ba52f75 100644 --- a/deps/repos.MODULE.bazel +++ b/deps/repos.MODULE.bazel @@ -116,11 +116,11 @@ http_archive( patches = [ "//deps/openssl:0001-Set-the-install-name-to-use-rpath-instead-of-absolut.patch", ], - sha256 = "a8c0d28a529ca480f9f36cf5792e2cd21984552a3c8e4aa11a24aa31aeac98e8", - strip_prefix = "openssl-3.5.7", + sha256 = "a8f84a39918ec6415ce765d9b429d313ba97b8143169c172e734b9514464f5b2", + strip_prefix = "openssl-3.5.8", urls = [ - "https://dd-agent-omnibus.s3.amazonaws.com/bazel/openssl-3.5.7.tar.gz", - "https://www.openssl.org/source/openssl-3.5.7.tar.gz", + "https://dd-agent-omnibus.s3.amazonaws.com/bazel/openssl-3.5.8.tar.gz", + "https://www.openssl.org/source/openssl-3.5.8.tar.gz", ], ) diff --git a/omnibus/config/software/openssl3.rb b/omnibus/config/software/openssl3.rb index 6a5e103c464..14d96e28440 100644 --- a/omnibus/config/software/openssl3.rb +++ b/omnibus/config/software/openssl3.rb @@ -28,10 +28,10 @@ # STAC-24773 D1 in python3.rb / datadog-agent-dependencies.rb). zlib is now # installed inline via @zlib//:install and is no longer an omnibus dependency. # -# Version is kept at 3.5.7 to match deps/openssl/version.bzl (STS is a patch -# release ahead of upstream base-7.78.2's 3.5.6; bumped in commit 42e0e0b8bf -# for CVE-2025-9230 / openssl issue #30728). -default_version "3.5.7" +# Must match deps/openssl/version.bzl — the Bazel repo rule is what actually +# builds OpenSSL, and a divergence here silently reports the wrong version. +# STS runs ahead of upstream base-7.78.2's 3.5.6 to carry CVE fixes. +default_version "3.5.8" relative_path "openssl-#{version}" diff --git a/releasenotes/notes/cve-2026-14456-openssl-3-5-8-4f1a9c2d7b3e6058.yaml b/releasenotes/notes/cve-2026-14456-openssl-3-5-8-4f1a9c2d7b3e6058.yaml new file mode 100644 index 00000000000..1e11fb4b6ba --- /dev/null +++ b/releasenotes/notes/cve-2026-14456-openssl-3-5-8-4f1a9c2d7b3e6058.yaml @@ -0,0 +1,6 @@ +--- +security: + - | + Upgrade the embedded OpenSSL to 3.5.8, addressing ``CVE-2026-14456`` + (unbounded memory growth in the QUIC server incoming channel queue) along + with the other CVEs fixed in that release. From c251351316c4d006ff4b93ad393574e3326cd8b7 Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Thu, 27 Aug 2026 19:56:22 +0000 Subject: [PATCH 2/3] Drop the CVE-2026-14456 exception now that the bump ships the fix The exception existed only because no fixed OpenSSL release had shipped, and its own renewal note says to bump instead as soon as one did. With 3.5.8 pinned the finding is gone, so keeping the entry would assert a no-upstream-fix status that is no longer true and would suppress the advisory if it ever reappeared for a different reason. Co-authored-by: Cve Ticket Reconciler --- .../stackstate-k8s-agent/CVE-2026-14456.yaml | 35 ------------------- 1 file changed, 35 deletions(-) delete mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-14456.yaml diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-14456.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-14456.yaml deleted file mode 100644 index d1ae29ad6cd..00000000000 --- a/exceptions/stackstate-k8s-agent/CVE-2026-14456.yaml +++ /dev/null @@ -1,35 +0,0 @@ -schema_version: '1' -vulnerability: - id: CVE-2026-14456 - severity: HIGH -product: - consumer: stackstate-k8s-agent - image: quay.io/stackstate/stackstate-k8s-agent -component: - purl: pkg:generic/openssl@3.5.7 - paths: - - opt/stackstate-agent/embedded/lib/libssl.so.3 - - opt/stackstate-agent/embedded/lib/libcrypto.so.3 - - opt/stackstate-agent/embedded/bin/openssl -status: accepted_pending_upstream_fix -reason: no_upstream_fix_published -expires: '2026-09-02' -owner: "@StackVista/observability-team" -upstream_owner: openssl -upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-14456 -statement: | - Scanners report the fix as 3.5.8, 3.6.4 or 4.0.2. None of those exist: the - newest releases in each line are 3.5.7, 3.6.3 and 4.0.1, and OSV enumerates - all three as affected. The fix landed upstream on 2026-08-12 but has not been - released, so the advertised fixed versions are anticipated release numbers - rather than shipped tarballs. 3.5.7 is what we already pin and is the newest - 3.5.x, so there is no bump to make. - - The vulnerable path is the QUIC server listener accepting Initial packets for - unknown connection IDs. The agent is a client and runs no OpenSSL QUIC - listener, and the OpenSSL FIPS module is outside the affected boundary. - - The date above is a short review deadline, not an acceptance -- re-check for - a released 3.5.x before renewing, and bump all four coordinated pins together - (deps/openssl/version.bzl, deps/repos.MODULE.bazel, and openssl3.rb). - Tracked in StackVista/stackstate-agent#489. From 2d47cce30fc428d84919c0b9f3b4a8f2aa330025 Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Fri, 28 Aug 2026 14:45:41 +0000 Subject: [PATCH 3/3] Stop the patch-0002 note from naming a specific 3.5.x pin The note explains why patch 0002 is absent; naming 3.5.7 as the version that carries the fix upstream makes it read as the current pin, which this branch has already moved past. Co-authored-by: Cve Ticket Reconciler --- deps/repos.MODULE.bazel | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/deps/repos.MODULE.bazel b/deps/repos.MODULE.bazel index 52c8ba52f75..816a76091d7 100644 --- a/deps/repos.MODULE.bazel +++ b/deps/repos.MODULE.bazel @@ -107,9 +107,9 @@ http_archive( patch_strip = 1, # [sts] STAC-24773 B1 fix-up 3: patch 0002 dropped. It cherry-picks an # April 2026 upstream fix for OSSL_PARAM_BLD_push_octet_* NULL handling - # (openssl issue #30728); openssl-3.5.7 (bumped from 3.5.6 in commit - # 1740d83631 / STAC-25035) already incorporates that fix, so re-applying - # the patch fails with CONTENT_DOES_NOT_MATCH_TARGET at line 383. Surfaced + # (openssl issue #30728); every 3.5.x from 3.5.7 on already incorporates + # that fix, so re-applying the patch fails with + # CONTENT_DOES_NOT_MATCH_TARGET at line 383. Surfaced # by B1 because @rpm//:install is the first openscap-chain Bazel target # that transitively pulls @openssl — `//packages/agent/dependencies:install` # (the only Bazel target hit by STAC-24773's pre-B1 commits) doesn't.