OpenSSL critical Vulnerability in AzureML Model Deployment to Kubernetes

Question

I have an issue with OpenSSL, I am using the following command to install the latest version of OpenSSL in my Base Docker Image of Azure ML Deployment as the older version has some critical security vulnerability. However, the final image still has the older versions of OPENSSL, it could either be that or AzureML is installing the packages by itself, can anyone tell me how to get past this issue? or delete older versions of OpenSSL?

FROM ubuntu:18.04

# Install dependencies:
RUN apt-get update  && apt-get -y install openssl

Answer 1

To install OpenSSL based on the required version, we need to install PERL first, then go with the OpenSSL installation based on the version required.

# Install PERL before going with Open SSL

RUN apt-get update \
    && apt-get install -y ca-certificates wget bash \
    && apt-get -qy install perl

Remove the current existing version of OpenSSL

RUN apt-get -y remove openssl

Run the installation through TAR Command

RUN apt-get -qy install gcc 


RUN apt-get -q update && apt-get -qy install wget make \
    && wget https://www.openssl.org/source/openssl-1.1.1g.tar.gz\
    && tar -xzvf openssl-1.1.1o.tar.gz \
    && cd openssl-1.1.1o \
    && ./config \
    && make install

Based on the TAR file and the version, it will install the updated version of OpenSSL.

We can’t directly install using apt-get command.