I just want to call out here that by installing the package mentioned above, you are introducing vulnerabilities to your system. Again, there is a reason that Ubuntu (and other distros) are no longer shipping this version.
As a test, I started a container running Ubuntu 22.04, installed this package as mentioned above, and then ran a scan with a couple of container scanning tools.
According to Snyk there are 9 vulnerabilities (6 medium severity and 3 high severity) in this version of libssl.
According to Grype, there are 13 vulnerabilities (4 low, 6 medium, 3 high):
Sure these issues still exist under 20.04 (and any distro that ships this version), but I don’t know if people are thinking about the implications of installing deprecated versions of libraries on newer systems.
Again I would file bug requests, or upvote an existing bug request, as that shows MongoDB that this is something they should focus on. While Stennie and other people report on what they see here to others within the MongoDB organization, bug reports get more traction and notice within MongoDB.
5 Likes
