yes, but only things that use openssl that you connect to untrusted input. (a substantial number, but far from all) Generally though, this should only require

yes, but only things that use openssl that you connect to untrusted input. (a substantial number, but far from all) Generally though, this should only require patching images that provide openssl, which should be expected to stay up to date, not the utilities which use openssl. The utilities should be picking an openssl-providing parent image - assuming that's the case, you'd just rebuild. That would pull in the new openssl image, rebuild against that newer target, and that'd be the end.