Is PeopleSync Affected by OpenSSL Vulnerabilities of 01 Nov 2022?

🤔 Problem

On November 1st 2022, two security issues in OpenSSL were made public. These are:

• X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602)

• X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786)

See:

• https://www.openssl.org/news/secadv/20221101.txt

• NVD - CVE-2022-3786 (nist.gov)

• NVD - CVE-2022-3602 (nist.gov)

Is PeopleSync affected by these vulnerabilities?

🌱 Solution

No, PeopleSync is not affected.

PeopleSync uses OpenSSL Version 1.1.1*, which is not vulnerable, according to the OpenSSL Security Advisory dated 01 Nov 2022.

To verify the exact version of OpenSSL used in the PeopleSync Frontend, run the following commands in a command line on the PeopleSync Frontend Server:

1. cd "C:\Program Files\messageconcept\PeopleSync Server\PHP"

2. php -i | findstr /C:"OpenSSL\ Library\ Version"

This will return the OpenSSL Version, for example:

OpenSSL Library Version => OpenSSL 1.1.1q 5 Jul 2022

📎 Related articles