topic Re: OpenSSL Vulnerability in Firewall and Security Management

OpenSSL Vulnerability

dnpl — Tue, 01 Nov 2022 15:44:00 GMT

On Tuesday, November 1, 2022, the OpenSSL project will release a new version of OpenSSL version 3.0.7 that will patch an as-yet-undisclosed vulnerability in current versions of OpenSSL. See following for details:

https://blog.qualys.com/vulnerabilities-threat-research/2022/10/31/qualys-research-alert-prepare-for-a-critical-vulnerability-in-openssl-3-0

This is likely to impact Check Point Scanners and possibly every linux-based device and third-party software product we have which uses a web portal for management.

Is Checkpoint planning to release a fix for vulnerability?

Re: OpenSSL Vulnerability

Chris_Atkinson — Tue, 01 Nov 2022 15:51:41 GMT

We published a blog that no doubt will be updated as additional information becomes known including relevant IPS signatures & SK articles.

https://blog.checkpoint.com/2022/10/30/openssl-gives-heads-up-to-critical-vulnerability-disclosure-check-point-alerts-organizations-to-prepare-now/

Re: OpenSSL Vulnerability

Danny — Tue, 01 Nov 2022 17:55:42 GMT

@dnpl : Your link writes "Only OpenSSL versions 3.0 through 3.0.6 are vulnerable", so Check Point is not affected.
Simply verify your openssl version with this command:

[Expert@fw:0]# cpopenssl version OpenSSL 1.1.1n 15 Mar 2022

Confirmed by Check Point in sk92447 and sk180206.

Re: OpenSSL Vulnerability

dnpl — Tue, 01 Nov 2022 18:00:02 GMT

Hi @Danny

So which version of OpenSSL does checkpoint use?

Thanks

Re: OpenSSL Vulnerability

Danny — Tue, 01 Nov 2022 18:01:28 GMT

Version 1.1.1 as shown in my post above and in sk92447.

Re: OpenSSL Vulnerability

_Val_ — Tue, 01 Nov 2022 19:38:41 GMT

We are not vulnerable. See here: https://community.checkpoint.com/t5/General-Topics/CVE-2022-3602-amp-CVE-2022-3786-in-relation-to-Check-Point/m-p/160942#M26896