logo
Apache Lounge
Webmasters

 

About Forum Index Downloads Search Register Log in RSS X


Keep Server Online

If you find the Apache Lounge, the downloads and overall help useful, please express your satisfaction with a donation.

or

Bitcoin

A donation makes a contribution towards the costs, the time and effort that's going in this site and building.

Thank You! Steffen

Your donations will help to keep this site alive and well, and continuing building binaries. Apache Lounge is not sponsored.
Post new topic   Forum Index -> Other Software View previous topic :: View next topic
Reply to topic   Topic: Does OpenSSL CVE-2022-2068 affect httpd 2.4.54 win64 VS16?
Author
jeaton



Joined: 08 Jul 2022
Posts: 1

PostPosted: Sun 10 Jul '22 6:04    Post subject: Does OpenSSL CVE-2022-2068 affect httpd 2.4.54 win64 VS16? Reply with quote

Our security app (Tenable) is complaining that OpenSSL 1.1.1o installed with httpd 2.4.54 win64 VS16 is affected by CVE-2022-2068.

I just wanted to know if that is really the case. If so, is there a newer build with OpenSSL 1.1.1p or q that I could install? Rolling Eyes
Back to top
Steffen
Moderator


Joined: 15 Oct 2005
Posts: 3094
Location: Hilversum, NL, EU

PostPosted: Sun 10 Jul '22 9:04    Post subject: Reply with quote

OpenSSL 1.1.1p is already available on the download page.

The script is not part of our download.

In the OpenSSL announcement;
Quote:
The c_rehash script does not properly sanitise shell metacharacters to
prevent command injection. This script is distributed by some operating
systems in a manner where it is automatically executed. On such operating
systems, an attacker could execute arbitrary commands with the privileges
of the script.

Use of the c_rehash script is considered obsolete and should be replaced
by the OpenSSL rehash command line tool. (CVE-2022-2068)
Back to top


Reply to topic   Topic: Does OpenSSL CVE-2022-2068 affect httpd 2.4.54 win64 VS16? View previous topic :: View next topic
Post new topic   Forum Index -> Other Software