Forum Discussion
OpenSSL
We have the recommendation to update OpenSSL. However, we can not figure out how to actually do this. There seems to be no installed location of OpenSSL so how can we update this? I have found a few posts/comments that have led me to this page New OpenSSL v3 vulnerability: prepare with Microsoft Defender for Cloud - Microsoft Community Hub but this doesn't actually help you at all. Going to OpenSSL's site for download just gives you a repository of files that don't actually update anything. So what are we supposed to do to get this remediated?
We are facing the same situation and it seems that the version of OpenSSL that is used in various apps is hardcoded to the app itself, so even installing the latest version to users does nothing as the app won't try to use the latest version it can see available, but instead will only use the version that is included in the app.
An example of that is PowerBI Desktop install. We have hundreds of issues for this. Also, for OpenSSL 1.1.1 is now EOL, but we still have software that is still using that version even though the version of that software if fully up to date, so the issue is the software vendors as we are reliant of them to make these changes.
Annoyingly, as you say, there is no uninstall for the multiple versions of OpenSSL, unless you have explicitly installed it on a users machine via Winget or similar
https://wingetgui.com/apps/ShiningLight-OpenSSL
If any one does have a solution to this, please let people know.
I found this bit of PowerShell which when run as admin will let you know where and what is installed, run from root of c:PS C:\> Get-childItem libssl* -Recurse -ErrorAction SilentlyContinue | select versioninfo -ExpandProperty versioninfo | sort ProductVersion,Filename | ft -auto
For me it found mostly windows software without update options.
The ones at issue are
My best actions so far include
- delete C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\ (we dont use salesforce)
- Update everything (zoom especially)
- Install OpenSSL v 3.2.1 from a trusted repository. (or you could make your own from source)
Now I'm waiting for Microsoft to update the libraries for
- Onedrive
- C:\Windows\System32\DriverStore\FileRepository\iclsclient
fatherosam_1 - The February version of Power BI Desktop has updated the OpenSSL from 3.0.9 to 3.0.11 but that is still vulnerable. The latest secure version is 3.0.13.
Have you reported the Microsoft applications to MSRC? I was able to get them to accept a report for CURL last year but they didn't accept for Power BI when I tried.
Not yet - I have raised it more generally.
And so far I'm on my third hand off (not our area I'll pass you onto ...)
with MS Support
I have found vulnerable editions in system32 drivers, onedrive sync libraries and office ODBC, along with Power bi and others
I'll just keep answering questions until someone finally takes it on
