Topic: Updating OpenSSL to 3.1.5

[NotEnoughSteel]

Hello,
Our vulnerability scans have picked up out-of-date OpenSSL files within an Apache install. The current version of Apache is 2.4.58 and the version of openssl.exe and libssl-3-64x.dll are both 3.1.3. Scans recommend updating these files to 3.1.5 to resolve the specified vulnerability (CVE-2023-5678).
Is it possible to only update these 2 files separately from the latest Apache package by overwriting just the two target files, or will this break Apache and will actually need the entire package to be updated?

[Steffen]

Current download is already 3.1.5

[NotEnoughSteel]

I already know the latest release is 3.1.5. The download I got for Apache 2.4.58 sometime earlier was released with 3.1.3. My question was can I simply replace those OpenSSL files individually or will I need to perform another 'update' to Apache even though the Apache version will remain the same?
I'm asking because updating Apache itself is much more complicated over just replacing 2 individual files.

[tangent]

If you choose to overwrite some of the OpenSSL related files in Apache with later versions, and things still appear to work ok, there's no guarantee you won't break some functionality.

There are also other files involved with SSL services, e.g. libcrypto-3-x64.dll, plus module linkage through mod_ssl.so, mod_session_crypto.so, etc.

Why would you want to take such a risk with your service, especially where security is concerned?

I'd advise updating.

Note, if your concern is refreshing various configuration settings below the default Apache directories, you can always develop a configuration where these files are located below a separate directory tree, e.g. Apache24\common\conf, Apache24\common\certificates, Apache24\common\logs, and you simply include your configuration settings from the end of the default Apache24\conf\httpd.conf. Somewhat easier to maintain.

[James Blond]