node:12.13/14-slim ships with unsupported OpenSSL?

[IdanAdar]

See in https://www.openssl.org/policies/releasestrat.html

Version 1.1.1 will be supported until 2023-09-11 (LTS).
Version 1.1.0 will be supported until 2019-09-11.

In the latest node:12.13-slim, openssl version returns OpenSSL 1.1.0l 10 Sep 2019

[IdanAdar]

@SimenB In reading through the comments of your PR it seems that you're basically dropping OpenSSL completely from the base image, which means I guess that I should install it myself, but I tried this and it still installed that same old OpenSSL version, so how is this helping to resolve the issue? How do I then install the latest OpenSSL version?

[SimenB]

I don't know if it's been released for stretch? You could use buster, which is debian 10 instead of debian 9.

This will solve it in that we will no longer ship an image with openssl installed. How to install a given version of openssl into debian:stretch-slim is a separate issue. A quick google seems to indicate it cannot be done out of the box: https://www.reddit.com/r/debian/comments/b3rbf2/openssl_111_tls_13_under_debian_stretch/

[IdanAdar]

Well, we're using node:12.13-slim, that one is using debian 9 no? Not much I can do about that... unless someone updates slim to use debian 10.

[SimenB]

We have buster images, docker run node:12.13-buster-slim

[IdanAdar]

So with node:12.13-buster-slim as-is today apt-get install openssl should provide OpenSSL 1.1.1d?

[SimenB]

You might need apt-get update first but otherwise yeah

[brandonw]

Removing the package causes any new images that are based off of these images to no longer have a default config, which implicitly reduces the SECLEVEL for all openssl usage on that image.

It may be useful to notify consumers of this image that they should configure a reasonable openssl.cnf in the Best Practices section of the README.

I can't find any release notes for these images, but if they exist, an amended release note that if you use openssl, an openssl.cnf must now be configured in each image instead of inheriting the package openssl.cnf would also be useful.