### Author:  [@hexa](https://discourse.nixos.org/u/hexa)
#### Post date: [October 31, 2022, 3:00pm UTC](https://discourse.nixos.org/t/openssl-3-0-7-update-2022-11-01-faq/22875/1 "2022-10-31T15:00:37Z")
## What is this post about?
Tomorrow (2022-11-01) the OpenSSL team will release a critical security update to their 3.0 tree. See the [official announcement](https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html).
## What does critical mean?
Critical means, that the upcoming vulnerability is likely exploitable in a common configuration scenario. See [Security Policy | OpenSSL Library](https://www.openssl.org/policies/general/security-policy.html) for the full explanation.
**CVE-2022-3602 has meanwhile been downgraded to `HIGH` severity, as it is probably not exploitable**
## How do I know if I am affected?
- The NixOS 22.05 release still defaults to OpenSSL 1.1 and is mostly unafffected with the exception of the nginx HTTP server, which has been overriden to use OpenSSL 3.0.
- NixOS unstable on the other hand uses OpenSSL 3.0 by default and will therefore be widely affected.
## How will this issue be handled within nixpkgs?
- For the stable release we plan to push the upgrade directly into `release-22.05`, given the minimal rebuild amount involved.
- For the unstable release we plan to merge the update into the running `staging-next` cycle, that is in an overall good state, and then shortly thereafter into `master`.
- Once the upgrades reach the `master` and `release-22.05` branches, we will immediately trigger an update to the respective `-small` channels, since they are more likely to be used by infrastructure. They also provide the basis for the `nixos-unstable` and `nixos-22.05` channels, which will follow shortly thereafter.
## When do the updates arrive on the channels?
We will add links to the [nixpk.gs PR tracker](https://nixpk.gs/pr-tracker.html) here once the relevant pull requests are up.
- NixOS Unstable: [Making sure you're not a bot!](https://nixpk.gs/pr-tracker.html?pr=198999)
- NixOS 22.05: [Making sure you're not a bot!](https://nixpk.gs/pr-tracker.html?pr=199001)
## What can I do to mitigate the issue right now?
- On NixOS 22.05 you can downgrade the OpenSSL version used by nginx, **unless you explicitly enabled and are relying on kTLS** :
- An overlay for NixOS unstable, that downgrades the `openssl` attribute is not recommended, given that it is very expensive to build and entirely untested.
- Consider disabling or restricting exposed services for the time being, where possible.
## What can I do to mitigate the issue, once the update is available?
- If you’re not in a hurry, wait for the channels to catch up and rebuild.
- If you’re in a hurry you can replace the OpenSSL runtime dependency without doing a full rebuild:
## Who authored this?
This FAQ was prepared by multiple people in the [#security-discuss:nixos.org](https://matrix.to/#/#security-discuss:nixos.org) room on Matrix.
---
### Author:  [@TLATER](https://discourse.nixos.org/u/TLATER)
#### Post date: [October 31, 2022, 4:48pm UTC](https://discourse.nixos.org/t/openssl-3-0-7-update-2022-11-01-faq/22875/2 "2022-10-31T16:48:27Z")
`nix-store -qR /run/current-system | grep openssl`
followed by a
`nix why-depends --all /run/current-system /nix/store/`
can also give a quick run-down of what packages you have installed that currently depend on openssl 3.x, and is a bit more generic than relying on having only 22.05 packages installed.
_Edit: @ElvishJerricco is right, without --all only the first hit will be listed_
---
### Author:  [@ElvishJerricco](https://discourse.nixos.org/u/ElvishJerricco)
#### Post date: [October 31, 2022, 4:51pm UTC](https://discourse.nixos.org/t/openssl-3-0-7-update-2022-11-01-faq/22875/3 "2022-10-31T16:51:22Z")
I would recommend adding `--all` to that `why-depends` command.
---
### Author:  [@hexa](https://discourse.nixos.org/u/hexa)
#### Post date: [November 1, 2022, 3:48pm UTC](https://discourse.nixos.org/t/openssl-3-0-7-update-2022-11-01-faq/22875/4 "2022-11-01T15:48:13Z")
OpenSSL 3.0.7 is out, the pull request for staging-next is up and labeled for backport. Was just merged.
[https://github.com/NixOS/nixpkgs/pull/198999](https://github.com/NixOS/nixpkgs/pull/198999)
---
### Author:  [@Solene](https://discourse.nixos.org/u/Solene)
#### Post date: [November 1, 2022, 3:59pm UTC](https://discourse.nixos.org/t/openssl-3-0-7-update-2022-11-01-faq/22875/5 "2022-11-01T15:59:32Z")
The NixOS community have been greatly responsive to this security issue announcement, thank you very much for all the clear explanations 🙏🏼
---
### Author:  [@hexa](https://discourse.nixos.org/u/hexa)
#### Post date: [November 1, 2022, 4:12pm UTC](https://discourse.nixos.org/t/openssl-3-0-7-update-2022-11-01-faq/22875/6 "2022-11-01T16:12:25Z")
Random updates:
- [Filo Sottile](https://www.twitch.tv/filosottile) is looking into the vulnerability live on Twitch right now.
- CVE-2022-3602 was downgraded from `CRITICAL` to `HIGH` severity
- The advisory is available at [https://www.openssl.org/news/secadv/20221101.txt](https://www.openssl.org/news/secadv/20221101.txt)
- The fix for CVE-2022-3602 is [Fix CVE-2022-3602 in punycode decoder. · openssl/openssl@fe3b639 · GitHub](https://github.com/openssl/openssl/commit/fe3b639dc19b325846f4f6801f2f4604f56e3de3)
- Eval for staging-next is running currently, 22.05-small is following next
---
### Author:  [@bb010g](https://discourse.nixos.org/u/bb010g)
#### Post date: [November 1, 2022, 4:12pm UTC](https://discourse.nixos.org/t/openssl-3-0-7-update-2022-11-01-faq/22875/7 "2022-11-01T16:12:59Z")
The `release-22.05` backport PR has also just been merged:
[https://github.com/NixOS/nixpkgs/pull/199001](https://github.com/NixOS/nixpkgs/pull/199001)
PR tracker: [https://nixpk.gs/pr-tracker.html?pr=199001](https://nixpk.gs/pr-tracker.html?pr=199001)
---
### Author:  [@yureka](https://discourse.nixos.org/u/yureka)
#### Post date: [November 1, 2022, 4:15pm UTC](https://discourse.nixos.org/t/openssl-3-0-7-update-2022-11-01-faq/22875/8 "2022-11-01T16:15:48Z")
I have patched my systems with the replaceRuntimeDependencies option:
```nix
system.replaceRuntimeDependencies = [
({
original = pkgs.openssl.out;
replacement = let
nixpkgsfixed = builtins.fetchTarball "https://github.com/NixOS/nixpkgs/archive/eeca5969b3f42ac943639aaec503816f053e5e53.tar.gz";
inherit (pkgs.callPackage (nixpkgsfixed + "/pkgs/development/libraries/openssl") {}) openssl_3;
in openssl_3.out;
})
];
```
Had to add `--impure` because replaceRuntimeDependencies runs into errors with pure eval mode otherwise.
**EDIT: previous version was broken, because it replaced only the occurrences of the .bin output**