Hi I have question regarding Hydra external dependencies in context of CVE-2022-0778, we are using image v1.10.7-sqlite. I see there is build docker with CGO enabled: https://github.com/ory/hydra/blob/e5295c6bb7188978ba6310c049f33c47a407d7a7/.docker/Dockerfile-build#L11 I wonder if Hydra is actually somehow using OpenSSL in a way that CVE actually apply?

I can confirm that the image is build using cgo we don't use openssl directly, but maybe go stdlib will use it? does the alpine version of that image contain a vulnerable openssl version?

If I'm looking correctly it uses 3.14.2

I see, latest release uses

3.15

but I am not sure what it actually uses in the end 🤔

the main think I'm looking for if Hydra is doing potential certifcate parsing that could cause the described dos

I don't think we use it as go libraries typically don't use c dependencies randomly, and you can compile hydra without cgo without a problem but I'd have to check

go uses its own tls library, it doesn't use openssl