升级openssl以解决docker openjdk的DSA-5139-1：17.0-jdk-slim-bullseye

Question

我正在我的Docker文件中使用Debian JDK图像，该文件引入了安全性vulnaribilty dsa-5139-1 [https://snyk.io/test/docker/openjdk%3a17.0-jdk-slim-bullseye]

这是我的docker文件 -

FROM openjdk:17-jdk-slim-bullseye

RUN apt-get update \
    && apt-get install -y ca-certificates wget bash

当我构建图像时，它给了我图像时，它给了我下面的OpenSSL版本 -

C:\docker-test>docker run -it openssl_test openssl version
OpenSSL 1.1.1n  15 Mar 2022

我尝试强制安装OpenSSL 1.1.1o，但是当我进入Bash并运行OpenSSL版本时，它总是向我显示相同的版本（1.1.1N） -

FROM openjdk:17-jdk-slim-bullseye

RUN apt-get -y remove openssl

RUN apt-get update \
    && apt-get install -y ca-certificates wget bash
    
RUN wget https://www.openssl.org/source/openssl-1.1.1o.tar.gz 

然后我在下面尝试强制安装OpenSSL 1.1。 1o但似乎“焦油”不起作用 -

FROM openjdk:17-jdk-slim-bullseye

RUN apt-get -y remove openssl

RUN apt-get update \
    && apt-get install -y ca-certificates wget bash \
    && wget https://www.openssl.org/source/openssl-1.1.1o.tar.gz \
    && tar -xzvf openssl-1.1.1o
    
WORKDIR /openssl-1.1.1o
RUN ./config --prefix=/usr/local/openssl --openssldir=/usr/local/openssl && make && make install

在构建图像时我会遇到此错误 -

#5 12.01 2022-05-20 19:22:46 (3.01 MB/s) - ‘openssl-1.1.1o.tar.gz’ saved [9856386/9856386]
#5 12.01
#5 12.01 tar (child): openssl-1.1.1o: Cannot open: No such file or directory
#5 12.01 tar (child): Error is not recoverable: exiting now
#5 12.01 tar: Child returned status 2
#5 12.01 tar: Error is not recoverable: exiting now

任何帮助都将不胜感激。

Answer 1

这对我有用 -

FROM openjdk:17-jdk-slim-bullseye

# Perl is required to install openssl
RUN apt-get update \
    && apt-get install -y ca-certificates wget bash \
    && apt-get -qy install perl

# Remove current openssl               
RUN apt-get -y remove openssl

# This is required to run “tar” command
RUN apt-get -qy install gcc 

RUN apt-get -q update && apt-get -qy install wget make \
    && wget https://www.openssl.org/source/openssl-1.1.1o.tar.gz \
    && tar -xzvf openssl-1.1.1o.tar.gz \
    && cd openssl-1.1.1o \
    && ./config \
    && make install

ENV PATH "$PATH:/usr/local/ssl/bin"

这显示了当前版本 -

C:\docker-test>docker run -it openssl_test /bin/bash
root@e28ea8c1fb63:/# openssl version
OpenSSL 1.1.1o  3 May 2022 (Library: OpenSSL 1.1.1n  15 Mar 2022)