Forum Discussion
Update OpenSSL recommendation
Hi sumo83,
thanks for your question.
As per a post on the https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/new-openssl-v3-vulnerability-prepare-with-microsoft-defender-for/ba-p/3666487, the OpenSSL team has identified two high-severity vulnerabilities: CVE-2022-3602 and CVE-2022-3786.
All OpenSSL versions between 3.0.0 and 3.0.6 are affected, and users of OpenSSL 3.x are advised to promptly upgrade to version 3.0.7 to mitigate the potential impact of these vulnerabilities.
To address this vulnerability, follow the instruction in the [Microsoft Defender for Cloud](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/new-openssl-v3-vulnerability-prepare-with-microsoft-defender-for/ba-p/3666487) blog post.
Microsoft Defender for Cloud offers various methods to quickly assess vulnerability and prioritize actions. Utilize attack path analysis to identify and prioritize remediation for workloads posing the highest risk to your organization. The cloud security explorer allows you to hunt for all impacted workloads related to the OpenSSL v3 vulnerability, offering additional context for prioritization. Leverage vulnerability assessments for VMs, containers, and container images to prioritize remediation for the most critical workloads.
You can use these links for more information:
(1) [New OpenSSL v3 vulnerability: prepare with Microsoft Defender for Cloud](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/new-openssl-v3-vulnerability-prepare-with-microsoft-defender-for/ba-p/3666487)
(2) [CERT-EU - UPDATE: OpenSSL Critical Vulnerability](https://cert.europa.eu/publications/security-advisories/2022-073/)
(3) [OpenSSL: Update zum Schließen der kritischen Sicherheitslücke verfügbar - heise online](https://www.heise.de/news/OpennSSL-Update-zum-Schliessen-der-kritischen-Sicherheitsluecke-verfuegbar-7326009.html)
Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.
If the post was useful in other ways, please consider giving it Like.
Kindest regards,
Leon Pavesic
(LinkedIn)
c:\packages\plugins\microsoft.azure.security.monitoring.azuresecuritywindowsagent\1.8.0.76\libcrypto-1_1-x64.dll
c:\packages\plugins\microsoft.azure.security.monitoring.azuresecuritywindowsagent\1.8.0.76\libssl-1_1-x64.dll
c:\packages\plugins\microsoft.guestconfiguration.configurationforwindows\1.29.44.0\dsc\gc\libcrypto-1_1-x64.dll
c:\packages\plugins\microsoft.guestconfiguration.configurationforwindows\1.29.44.0\dsc\gc\libssl-1_1-x64.dll
Will manual upgrading of openssl to newer version help with those references? Or do I somehow update them?
- LeonPavesicNov 13, 2023Silver Contributor
Hi sumo83,
unfortunately, I’m not sure if manual upgrading of OpenSSL to a newer version will help with the references you mentioned.
You should use this article as an official guide:
New OpenSSL v3 vulnerability: prepare with Microsoft Defender for Cloud - Microsoft Community Hub
Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.If the post was useful in other ways, please consider giving it Like.
Kindest regards,
Leon Pavesic
(LinkedIn)- tophnealNov 16, 2023Copper ContributorThe linked blog post (https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/new-openssl-v3-vulnerability-prepare-with-microsoft-defender-for/ba-p/3666487) being suggested to follow for remediation of this issue does not seem to apply anymore. MS has rearranged and renamed so many areas of Azure/Entra/Defender that I can't even find "Attack Paths," rendering this guide useless.
Has anyone found any other solutions to this?