Falco 0.45.2 updates OpenSSL to 3.5.9 and refreshes CA trust stores

The Falco cloud-native runtime security project has released version 0.45.2. This minor update focuses on hardening the security of the Falco engine and its containerized distributions through dependency updates and certificate management.

Key changes include a bump to the bundled OpenSSL library and a refresh of the Certificate Authority (CA) trust stores within the packaging. These updates are designed to address specific security incidents and ensure compliance with modern TLS standards for users running Falco in production environments.

Security and packaging enhancements

• OpenSSL Upgrade: The project has bumped the bundled OpenSSL version to 3.5.9 LTS via CMake, which implements TLS security level 2 requirements.
• TLS Security Level 2: This change enforces stricter cryptographic standards, requiring RSA/DSA/DH keys to be at least 2048 bits and Elliptic Curve (EC) keys to be at least 224 bits.
• CA Trust Store Refresh: The packaging has been updated to refresh image CA trust stores in response to the eMudhra incident, ensuring valid certificate verification.
• Component Bundling: This release bundles container plugin version 0.7.6 and falcoctl version 0.14.3, while maintaining the Buster loader with corrected trust settings.

Why it matters

For security engineers and DevOps practitioners, this update is critical for maintaining compliant and secure runtime monitoring in Kubernetes and other cloud-native environments. The move to TLS security level 2 ensures that Falco's communication channels meet modern cryptographic requirements, mitigating risks associated with weaker key lengths.