Keep Server Online
If you find the Apache Lounge, the downloads and overall help useful, please express your satisfaction with a donation.
or
A donation makes a contribution towards the costs, the time and effort that's going in this site and building.
Thank You! Steffen
Your donations will help to keep this site alive and well, and continuing building binaries. Apache Lounge is not sponsored.
| |
|
 Topic: Does OpenSSL CVE-2022-2068 affect httpd 2.4.54 win64 VS16? |
|
| Author |
|
jeaton
Joined: 08 Jul 2022
Posts: 1
|
 Posted: Sun 10 Jul '22 6:04 Post subject: Does OpenSSL CVE-2022-2068 affect httpd 2.4.54 win64 VS16? |
 |
|
Our security app (Tenable) is complaining that OpenSSL 1.1.1o installed with httpd 2.4.54 win64 VS16 is affected by CVE-2022-2068.
I just wanted to know if that is really the case. If so, is there a newer build with OpenSSL 1.1.1p or q that I could install?  |
|
| Back to top |
|
Steffen
Moderator
Joined: 15 Oct 2005
Posts: 3092
Location: Hilversum, NL, EU
|
| Posted: Sun 10 Jul '22 9:04 Post subject: |
|
|
OpenSSL 1.1.1p is already available on the download page.
The script is not part of our download.
In the OpenSSL announcement;
| Quote: | The c_rehash script does not properly sanitise shell metacharacters to
prevent command injection. This script is distributed by some operating
systems in a manner where it is automatically executed. On such operating
systems, an attacker could execute arbitrary commands with the privileges
of the script.
Use of the c_rehash script is considered obsolete and should be replaced
by the OpenSSL rehash command line tool. (CVE-2022-2068)
|
|
|
| Back to top |
|
|
|
|
|
|
