# OpenSearch and Updated nss fix CVE-2021-43527 **URL:** \ **Category:** OpenDistro\ **Tags:** releases, cve\ **Created:** [December 8, 2021, 11:50am UTC](https://forum.opensearch.org/t/opensearch-and-updated-nss-fix-cve-2021-43527/7900 "2021-12-08T11:50:59Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![guhan](https://avatars.discourse-cdn.com/v4/letter/g/f9ae1b/32.png) [@guhan](https://forum.opensearch.org/u/guhan)\ **Post date:** [December 8, 2021, 11:50am UTC](https://forum.opensearch.org/t/opensearch-and-updated-nss-fix-cve-2021-43527/7900/1 "2021-12-08T11:50:59Z")
Hello there, As i see now, Opensearch v1.2 was released on 23.nov.2021. However Amazon issued a security fix [CVE-2021-43527](https://alas.aws.amazon.com/AL2/ALAS-2021-1722.html) on [1.Dec.2021]. [Amazon Linux 2 release notes - Amazon Linux 2](https://aws.amazon.com/amazon-linux-2/release-notes/) Since opensearch uses this image as base, just wondering if opensearch v1.2 has that fix available or it will be included later? will there be a patch or v1.3 for opensearch in the near future? ---
**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\ **Post date:** [December 8, 2021, 6:37pm UTC](https://forum.opensearch.org/t/opensearch-and-updated-nss-fix-cve-2021-43527/7900/2 "2021-12-08T18:37:36Z")
hey @guhan! Thanks for bringing that up. I pushed this to the launch team and they’re working on how to get the fix to the community. ---
**Author:** ![ralph](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/ralph/32/1194_2.png) [@ralph](https://forum.opensearch.org/u/ralph)\ **Post date:** [December 9, 2021, 11:43am UTC](https://forum.opensearch.org/t/opensearch-and-updated-nss-fix-cve-2021-43527/7900/3 "2021-12-09T11:43:39Z")
this brings up a general question: is there a policy in place on how to handle security updates? both for libraries used by the software (i.e. also affecting binary downloads or even maven artifacts) as well as components of the docker images? i can see two options: - you have an update-test-and-release-ASAP strategy (i.e. CVE pops up, [dependabot](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates) (which i believe wasn’t properly enabled with [OpenSearch#664](https://github.com/opensearch-project/OpenSearch/issues/664) because i’ve never seen any PR from dependabot on any of your repos - probably something to look into again?)) creates a PR, you merge it, you create a fix release of the affected things) on all supported releases (whichever those are?) - you analyse the CVE and publish a documentation confirming that the CVE has no impact on opensearch / users of opensearch and that an update is thus not needed as a hotfix (can e.g. be done if an update is more complicated than the analysis) ---
**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\ **Post date:** [December 9, 2021, 5:38pm UTC](https://forum.opensearch.org/t/opensearch-and-updated-nss-fix-cve-2021-43527/7900/4 "2021-12-09T17:38:37Z")
@ralph There is actually some working going on with this. The project uses whitesource but there is some thoughts on using dependabot. You can find a [relevant discussion in this issue](https://github.com/opensearch-project/opensearch-build/issues/578) ---
**Author:** ![guhan](https://avatars.discourse-cdn.com/v4/letter/g/f9ae1b/32.png) [@guhan](https://forum.opensearch.org/u/guhan)\ **Post date:** [December 13, 2021, 7:04am UTC](https://forum.opensearch.org/t/opensearch-and-updated-nss-fix-cve-2021-43527/7900/5 "2021-12-13T07:04:55Z")
@searchymcsearchface , thanks for the update, looks like 1.2.1 released but it only fixed log4j issue. (Not NSS issue) What is the best way to create our own custom openearch image with 1.2.1 as base and update with appropriate NSS package 3.67.xxx ---
**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\ **Post date:** [December 13, 2021, 3:02pm UTC](https://forum.opensearch.org/t/opensearch-and-updated-nss-fix-cve-2021-43527/7900/6 "2021-12-13T15:02:33Z")
Humm. I was told that the NSS issue was solved with 1.2.1. Can you expand a bit why you think the NSS issues is not solved? ---
**Author:** ![JulesGraybill](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/julesgraybill/32/1420_2.png) [@JulesGraybill](https://forum.opensearch.org/u/JulesGraybill)\ **Post date:** [December 13, 2021, 3:17pm UTC](https://forum.opensearch.org/t/opensearch-and-updated-nss-fix-cve-2021-43527/7900/7 "2021-12-13T15:17:18Z")
Hi @guhan, OpenSearch 1.2.1 does indeed include a fix for [CVE-2021-4352](https://alas.aws.amazon.com/AL2/ALAS-2021-1722.html) (see the [release notes](https://github.com/opensearch-project/opensearch-build/blob/main/release-notes/opensearch-release-notes-1.2.1.md)). @ralph Yes, we update dependencies to pick up security fixes, as well as fix any known issues in the project code, with every new release. If an issue like the Log4j2 one shows up that warrants immediate attention, we don’t wait for the next scheduled release, and instead issue a patch release right away. ---
**Author:** ![guhan](https://avatars.discourse-cdn.com/v4/letter/g/f9ae1b/32.png) [@guhan](https://forum.opensearch.org/u/guhan)\ **Post date:** [December 15, 2021, 6:24am UTC](https://forum.opensearch.org/t/opensearch-and-updated-nss-fix-cve-2021-43527/7900/8 "2021-12-15T06:24:44Z")
Great, thanks @searchymcsearchface for the update ---
**Author:** ![guhan](https://avatars.discourse-cdn.com/v4/letter/g/f9ae1b/32.png) [@guhan](https://forum.opensearch.org/u/guhan)\ **Post date:** [December 15, 2021, 8:34am UTC](https://forum.opensearch.org/t/opensearch-and-updated-nss-fix-cve-2021-43527/7900/9 "2021-12-15T08:34:14Z")
@searchymcsearchface , out of curiosity, is opensearch-dashboard version also updated to 1.2.1 with fixes available ---
**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\ **Post date:** [December 15, 2021, 2:04pm UTC](https://forum.opensearch.org/t/opensearch-and-updated-nss-fix-cve-2021-43527/7900/10 "2021-12-15T14:04:59Z")
@guhan let me check on that. I know the team is a bit turned around with the Log4j fun, but it’s a good point. ---
**Author:** ![ZelinH](https://avatars.discourse-cdn.com/v4/letter/z/96bed5/32.png) [@ZelinH](https://forum.opensearch.org/u/ZelinH)\ **Post date:** [December 16, 2021, 12:32am UTC](https://forum.opensearch.org/t/opensearch-and-updated-nss-fix-cve-2021-43527/7900/11 "2021-12-16T00:32:12Z")
OpenSearch-Dashboards docker [image](https://hub.docker.com/layers/opensearchproject/opensearch-dashboards/latest/images/sha256-74a59e5618093847830ac9a7f1213894e7b56582e7c784b8e0d93e1feffae84e?context=explore) has been redeployed to fix [[CVE-2021-43527](https://alas.aws.amazon.com/cve/html/CVE-2021-43527.html)].