We have vulnerability CVE-2023-5363 to our Windows Server 2019, what the best way to patch/update and fix it? Is it part of Microsoft OS security hot fix? Or we need to install on our own from?

Question

We have vulnerability CVE-2023-5363 to our Windows Server 2019, what the best way to patch/update and fix it? Is it part of Microsoft OS security hot fix? Or we need to install on our own from?

Sharma, Raju 80

We have vulnerability CVE-2023-5363 to our Windows Server 2019, what the best way to patch/update and fix it? Is it part of Microsoft OS security hot fix? Or we need to install on our own downloading it from Open SSL? If so any guided steps? Where to install it?

Ben Baker Server Admin 0 Reputation points

2023-11-10T04:24:08.68+00:00

I also have the same situation here. Server is isolated and used as a backup server using VEEAM Data and Replication (latest version) - 12.0.0.1420 P20230718 via PostgreSQL 15.4 (updated in Oct).

It doesn't indicate which particular software needs to be updated which doesn't assist with rectifying the vulnerability besides OpenSSL, but what I can see is that there is a PostgreSQL 15.5 now released as of 9th of November 2023. If you are using PostgreSQL (check in Add / Remove Programs) then this would be the culprit and it needs to be updated from 15.x to the most recent 15.x version. DO NOT update from 15 to 16, this requires a thorough migration form what I've read.

@Microsoft Rep - Please pass this on to add this as a PostgreSQL update in Defender 365 >Discovered Vulnerabilities foreseeable future as this took quite some time out of my day to investigate.

EDIT: You can sometimes get hints from Defender 365 by going into the device > Software Inventory and it shows the File Path of the software but it can be unreliable in other circumstances as it shows ID's rather than appropriate folder or file names to isolate the required software to update.

Thank you,
Ben
Gbolahan Akeem Rajifuja 1 Reputation point

2024-01-22T18:20:11.7966667+00:00

The identification of the software culprit has not been made readily available.I have a couple of these CVEs related to opensssl i am interested in resolving.