which is the openssl version in sepm 14.3 RU5

[HARSHA PK]

Hello Team,

which is the openssl version in sepm 14.3 RU5

Does SEPM 14.3 RU5  using OpenSSL versions 3.0.0 to 3.0.5  it has this vulnerabilty -CVE-2022-3358

Kindly confirm ...

Regards

Harsha

[John Owens]

14.3 RU5 uses 3.0.2.

14.3 RU6 will have 3.0.7. 

This should be released soon.

------------------------------
John Owens
Strategic Support Engineer | Symantec Endpoint Security Division (SES)
Broadcom Software
------------------------------

[G Soyars]

Hi John,  can you explain the difference between these 3 different downloads of 14.3 RU5.  I'm still on RU4 and I don't know which download to use to update to RU5.

[levd]

Can you please post here when the 14.3 ru6 is available with a fix for the openssl vulnerability?

[John Owens]

Sure thing. Current eta is Monday 11/7.

------------------------------
John Owens
Strategic Support Engineer | Symantec Endpoint Security Division (SES)
Broadcom Software
------------------------------

[John Owens]

I would wait for 14.3 RU6 to upgrade. I would not upgrade to 14.3 RU5 at this time.

------------------------------
John Owens
Strategic Support Engineer | Symantec Endpoint Security Division (SES)
Broadcom Software
------------------------------

[Thomas Rennaker]

Is 14.3 RU5 the first version using openssl 3.0.X? We have some older versions installed and need to know if those are vulnerable. Is there a chart published somewhere that shows the openssl version for each SEP version?

[John Owens]

Support Content Notification - Support Portal - Broadcom support portal

------------------------------
John Owens
Strategic Support Engineer | Symantec Endpoint Security Division (SES)
Broadcom Software
------------------------------

[HARSHA PK]

Hi John,

Thank for the information

Regards

Harsha

[John Owens]

Keep in mind the Security Advisory is for CVE-2022-3786 & CVE-2022-3602.

You would want to open a case and ask about the older CVE-2022-3358. 

------------------------------
John Owens
Strategic Support Engineer | Symantec Endpoint Security Division (SES)
Broadcom Software
------------------------------

[YOUN Tit]

hi @John Owens

OPENSSL Security Advisory is for CVE-2022-3786 & CVE-2022-3602.
1. what is Symantec version 14.3 RU4 using OpenSSL version?
2. Does OpenSSL impact to Symantec version 14.3 RU4?

Thank you on a head for your answers ​

[John Owens]

Only SEPM 14.3 RU5 runs an OpenSSL version of 3.0.x. All previous versions run 1.1.x.x versions

------------------------------
John Owens
Strategic Support Engineer | Symantec Endpoint Security Division (SES)
Broadcom Software
------------------------------

[John Owens]

14.3 RU6 is available for download.

------------------------------
John Owens
Strategic Support Engineer | Symantec Endpoint Security Division (SES)
Broadcom Software
------------------------------

[Mahesh Sejwar]

it uses one of the OpenSSL impacted versions 3.0.2