OpenSSL Vulnerability

[dnpl]

On Tuesday, November 1, 2022, the OpenSSL project will release a new version of OpenSSL version 3.0.7 that will patch an as-yet-undisclosed vulnerability in current versions of OpenSSL. See following for details:

https://blog.qualys.com/vulnerabilities-threat-research/2022/10/31/qualys-research-alert-prepare-for...

This is likely to impact Check Point Scanners and possibly every linux-based device and third-party software product we have which uses a web portal for management.

Is Checkpoint planning to release a fix for vulnerability?

[Chris_Atkinson · Accepted solution]

We published a blog that no doubt will be updated as additional information becomes known including relevant IPS signatures & SK articles. 

https://blog.checkpoint.com/2022/10/30/openssl-gives-heads-up-to-critical-vulnerability-disclosure-c...

[Danny · Accepted solution]

@dnpl : Your link writes "Only OpenSSL versions 3.0 through 3.0.6 are vulnerable", so Check Point is not affected.
Simply verify your openssl version with this command:

[Expert@fw:0]# cpopenssl version
OpenSSL 1.1.1n  15 Mar 2022

Confirmed by Check Point in sk92447 and sk180206. 

[dnpl]

Hi @Danny 

So which version of OpenSSL does checkpoint use?

Thanks

[Danny]

Version 1.1.1 as shown in my post above and in sk92447.

[_Val_ · Accepted solution]

We are not vulnerable. See here: https://community.checkpoint.com/t5/General-Topics/CVE-2022-3602-amp-CVE-2022-3786-in-relation-to-Ch...