Forum Discussion

sumo83's avatar
sumo83
Iron Contributor
Nov 13, 2023

Update OpenSSL recommendation

Hi all,   I've been trying to find out how to deal with "openssl" recommendation that I get on almost all end user computers in Defender.   I'm just not sure how to deal with it... It doesn't see...
microsoft defender for endpoint
Remediation
LeonPavesic's avatar
LeonPavesic
Silver Contributor

Hi sumo83,

unfortunately, I’m not sure if manual upgrading of OpenSSL to a newer version will help with the references you mentioned.

You should use this article as an official guide:
New OpenSSL v3 vulnerability: prepare with Microsoft Defender for Cloud - Microsoft Community Hub


Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.


If the post was useful in other ways, please consider giving it Like.


Kindest regards,


Leon Pavesic
(LinkedIn)

tophneal's avatar
tophneal
Copper Contributor
Nov 16, 2023
The linked blog post (https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/new-openssl-v3-vulnerability-prepare-with-microsoft-defender-for/ba-p/3666487) being suggested to follow for remediation of this issue does not seem to apply anymore. MS has rearranged and renamed so many areas of Azure/Entra/Defender that I can't even find "Attack Paths," rendering this guide useless.

Has anyone found any other solutions to this?
  • AllisonHutchence's avatar
    AllisonHutchence
    Copper Contributor
    Nov 22, 2023

    tophneal I am struggling with the same.  I found several articles - and using the following powershell command (make sure to run powershell as an admin) - I was able to narrow in on where I have OpenSSL on our machines.

     

    Get-childItem libssl* -Recurse  -ErrorAction SilentlyContinue | select versioninfo -ExpandProperty versioninfo | sort ProductVersion,Filename | ft -auto

     

    The culprits for us are:

    Webex

    Zoom

    PowerBI Desktop

    Salesforce ODBC drivers installed by default in Office

    OneDrive

    And 2 locations within c:\windows\system32\driverstore\filerepository which seem to be linked to the Intel Trusted Connect Service Client

     

    I uninstalled Webex, Zoom, and PowerBI Desktop.  I deleted the Salesforce ODBC drivers.  OneDrive appears to updated itself overnight even though I have the same version this morning as I did last night - that is no longer showing up in my list.  I am left with the two locations for the Intel Trusted Connect Service Client and I am still looking for how I can update that.  I found this article - Surface Go update history - Microsoft Support - which seems to indicate the Nov 2022 update took care of updating the Intel Trusted Connect service client.  I don't have a surface go - but I did just go through the steps in the article and it did find an update for the chipset.  I'm going to reboot and see if that did anything - as of now - nothing changed.

     

  • sumo83's avatar
    sumo83
    Iron Contributor
    Nov 22, 2023

    tophneal - I see the attack path analysis in Defender for Cloud -> Left panel... in General section... However, it didn't help me with identifying openSSL much.

Resources