OpenSSL vulnerabilities showing in Defender Dashboard

@Jeff Thorne Thank you for reaching out to us, As I understand you have queries on the OpenSSL vulnerabilities showing in Defender Dashboard.

Researched on your issue and found few changes happened from 3.0.9 to 3.0.10 and notes for the same can be found here - https://www.openssl.org/news/openssl-3.0-notes.html

Could you help me which defender dashboard has discovered these vulnerabilities on your devices, if any screenshot which you can share (if it contains sensitive information, feel free to send me an email to 'AzCommunity@microsoft.com' with Sub - Attn: Givary so that I can review it further).

However similar issue was discussed in the past - https://msrc.microsoft.com/blog/2022/11/microsoft-guidance-related-to-openssl-risk-cve-2022-3786-and-cve-2202-3602/ where the mitigation was to update the OS/respective software having this DLL.

Also would recommend to check if you have any security updates pending for these devices, if yes install them and check if defender still reports.

Reference:

https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/new-openssl-v3-vulnerability-prepare-with-microsoft-defender-for/ba-p/3666487

https://techcommunity.microsoft.com/t5/microsoft-defender-vulnerability/reduce-openssl-3-0-vulnerabilities-risks-with-microsoft-defender/ba-p/3668567

Whether these alerts are false positive or not, I can tell after receiving the screenshot from the defender dashboard, so that I can discuss it with my team internally on the same.

Let me know if you have any further questions, feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

Hi,

i have same issue on this with component of SSMS c:\program files (x86)\microsoft sql server management studio 19\common7\ide\mashup\odbc drivers\simba spark odbc driver\libcurl32.dlla\openssl32.dlla\libcrypto-3.dll c:\program files (x86)\microsoft sql server management studio 19\common7\ide\mashup\odbc drivers\simba spark odbc driver\libcurl32.dlla\openssl32.dlla\libssl-3.dll c:\program files (x86)\microsoft sql server management studio 19\common7\ide\mashup\odbc drivers\simba spark odbc driver\openssl32.dlla\libcrypto-3.dll c:\program files (x86)\microsoft sql server management studio 19\common7\ide\mashup\odbc drivers\simba spark odbc driver\openssl32.dlla\libssl-3.dll software version detected is 3.0.8 by defender for cloud and defender endpoint in Azure. i haven't found any way to update it for SSMS.
Please share if you have any advise.

Hi Everyone,

As per my testing and research, I think this will be an ongoing vulnerability recommendation.

For example, Zoom addressed the vulnerability with OpenSSL 3.1.4 back in Jan 2024, screen capture below https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0068823

But, Microsoft reported the CVE-2024-2511 which says that multiple versions of OpenSSL still are impacted:

After some testing, I uninstalled Zoom and found that the vulnerability was gone, but Defender detected it again as Zoom as I reinstalled the latest version.

I did find the OpenSSL Recommendation helpful because there were apps and left over files that users in my organization where not using and were increasing the impact of this vulnerability, removing those specifics apps and files make the list shorter.

Hope my findings help you all.

In some product groups, there seems to be a misunderstanding about such an issue: Sometimes it's not about "does this vulnerability affect me?", but "how can I trust my security reporting?". Without updating the product to use the current version of openssl, I simply cannot install it any more on any of our devices. Also, Microsoft gets blamed for that, because they are deploying vulnerable code to our computers (it is completely unimportant whether the code is being used or not - it is there). Our security reporting is based on Defender Vulnerability Management. So, in this case Microsoft tells us to NOT use this software until it gets an update - in this case SSMS from Microsoft. PLEASE: when there is a vulnerability in a library you use: do NOT try to find out whether it will affect you or not - simply update. There is no legitimation for a known vulnerable library on a computer other than that there is currently no updated library available. But in this case, there is: simply update the library in your product.

I Got the same Issue. Strange thing it is on Onedrive I'm Not sure what the lastest version of ondrive is, becourse the version list on the Microsoft site is not up to date. But the Warning is on all version of onedrive. Here are some Exampels.

c:\program files\microsoft onedrive\24.101.0519.0010\libcrypto-3-x64.dll

c:\program files\microsoft onedrive\24.108.0528.0005\libcrypto-3-x64.dll

c:\program files\microsoft onedrive\24.101.0519.0010\libssl-3-x64.dll

c:\program files\microsoft onedrive\24.108.0528.0005\libssl-3-x64.dll