Corporate endpoint security?

Help
21

You could try openssl_1_1.

1 Like
22

Ok thanks I will try that.

23

Did you get libssl.so.1.0.0 dependency to work?

Iā€™m hitting the same wall with another package

1 Like
24

If it actually wants that version, and you canā€™t substitute with the newer libssl, you should check with your vendor, since that version is known to be vulnerable.

They may distribute a proprietary implementation, at which point youā€™d need to get your hands on that, or theyā€™re just selling you an inherently insecure tool. Or both while also violating a FOSS license, of course.

25

I donā€™t know for the original topic, but in my case we are talking about azure function core tools.

Iā€™ve provided some more details in this post: Azure Functions Core Tools missing a binary

Could it be possible to provide a newer version, when libssl.so.1.0.0 is the one that its asking for?

26

So currently Iā€™m using 1_1 and ignoring the dependency errors. So far this approach is working, but I havenā€™t got it working, since it seems like Iā€™ll need to create a NixOS module as well to get this to work (it involves systemd services etc).

27

I added this below buildInputs in the package:

  autoPatchelfIgnoreMissingDeps = [
    "libssl.so.1.0.0"
    "libcrypto.so.1.0.0"
    "libssl.so.10"
    "libcrypto.so.10"
    "libcrypt.so.1"
    "libxml2.so.2"
    "libssl.so.1.1"
    "libcrypto.so.1.1"
  ];
28

Itā€™s quite possible it will only ā€œworkā€ until you do some actual SSL, since those versions arenā€™t ABI compatible. Itā€™d be wise to find some kind of smoketest before committing too much :wink:

1 Like
29

I have the option to submit a ticket to Bitdefender to get this issue resolved via our companyā€™s IT department. Iā€™d be interested if anyone has any input in what exactly I should be asking for. It seems like the current ā€œopensslā€ in Nixpkgs is version 3.4.1. Should I ask them to upgrade to this, or is there an appropriate ā€œLTSā€ version of openssl they could use. Or just bump the version to something higher than the current libssl.so.1.0.0?

30

Iā€™d also like to see bitdefender working for NixOS.

Nixpkgsā€™ openssl_1_1 (version 1.1.1w) support ended 11 Sep 2023, and there are many vulns after then: Vulnerabilities 1.1.1 | OpenSSL Library.
It looks like they have premium support for 1.1.* for a fee.

openssl_3 (version 3.0.16 in stable) is at least LTS, with support ending 07 Sep 2026.
Hopefully 3.5 is in nixpkgs stable long before then, and could be a simpler jump for bitdefender too?

So, I recommend openssl 3.0.* (latest release is actually 3.0.17, in unstable).

Let us know how you fare. I could put in a support ticket too.

31

Thanks for the info @senorsmile - thatā€™s very helpful. I have submitted a ticket. If we hear back, I can post here, and you could put one in as well. Sound good?

32

Update - we have a case in for this - Bitdefender support replied that they have put in a feature request to add NixOS compatibility. See what comes of itā€¦