OpenSSL warns of critical security vulnerability

[atlantis2]

OpenSSL warns of critical security vulnerability with upcoming patch​

https://www.zdnet.com/article/openssl-warns-of-critical-security-vulnerability-with-upcoming-patch/

Does 3CX use openssl and if so which version?

 

[Pierre_3CX]

Hello,
Thanks for raising this topic, we do use OpenSSL but aren't affected by this issue as our versions are below 3.0.

 

[Tim Starke]

Hi Pierre,

In what context does 3CX use OPEN SSL?

 

[Pierre_3CX]

Hi Tim,
Well it's used in most SSL/TLS transactions such as those served by the web server (nginx).

 

[JohnPridgen]

Pierre,

Can you provide the specific openssl version being used in 3CX version 18 self hosted?

 

[bitn2]

Version 1.1.1n is used in V18 (418)

 

[Luke]

Hi Team,
Our vulnerability management has picked up that 3CX postgres has openssl code that is not secure.

C:\Program Files\3CX Phone System\Bin\pgsql\bin\psql.exe
Wondering if anyone knows when there will be an update for this?

PostgreSQL: Windows installer bundled OpenSSL executes code from unprotected directory

 

[Pierre_3CX]

Hi Luke, I'll send you a PM so we check this further, this is something different than the recent openssl topic though as the version used by postgresql is much lower.

 

[Luke]

Hi Luke, I'll send you a PM so we check this further, this is something different than the recent openssl topic though as the version used by postgresql is much lower.

replied