Community Corner — Nichol Goldstein (Progress) asked a question.

Edited November 1, 2022 at 6:34 PM
What You Need to Know: OpenSSL Vulnerability

On November 1, 2022, the OpenSSL Project released OpenSSL version 3.0.7. This release is a security-fix and addresses two "High" severity vulnerabilities, https://www.openssl.org/news/vulnerabilities.html.

 

Progress has already conducted a thorough review of our products and determined that none of our products are using the impacted version of OpenSSL as shipped and/or deployed.

 

To stay current with the latest information on this topic, please visit https://www.progress.com/security or, for the following products, you can also visit your respective blogs:

  • 6 answers
  • 1.43K views
Printed Carrier Bags Shop, Peter Judge, and 2 others like this.

  • Mark Haddon (Customer)

    OpenSSL v1.1.1 is EOF Sept 2023. I think that WS_FTP Server 2022.0 (8.8) currently uses OpenSSL V1.0.2? Will you be upgrading to OpenSSL v3.1?

     

  • Mia smith (Customer)

    On November 1, 2022, the OpenSSL Project released version 3.0.7, addressing two high-severity vulnerabilities. These security flaws could have significant implications for systems using affected versions. Fortunately, Progress has reviewed its products and confirmed that none of them use the impacted version of OpenSSL. Customers are encouraged to keep themselves updated on this issue by visiting Progress's security page or the respective blogs for specific products such as WhatsUp Gold and MOVEit / WS_FTP Pro / WS_FTP Server. The release underscores the importance of staying vigilant and up-to-date with software to protect against potential security threats.

  • Mark Haddon (Customer)

    thanks but all this tells us is that WS_FTP Server isn't vulnerable to OpenSSL V3.0.7 security flaws.

    The problem though is that WS_FTP Server is using OpenSSL v1.0.2zf and OpenSSL v1.1.1 is EOF September 2023 meaning surely that the version of OpenSSL used in WS_FTP Server will be EOF in Sept 2023? Surely this needs to be addressed?

     

    What's New in WS_FTP Server 2022.0 (8.8) (ipswitch.com)

This question is closed.