Re: CVE-2022-3602 and CVE-2022-3786 Critical OpenSSL 3.0.x security vulnerabilities

[Jochen Bern]

On 02.11.22 07:48, Turritopsis Dohrnii Teo En Ming wrote:

I have 2 internet-facing CentOS 7.9 Linux servers in Europe.
Are the patches available already? How do I patch OpenSSL on my CentOS 7.9
Linux servers?

https://github.com/NCSC-NL/OpenSSL-2022/blob/main/software/README.md

https://pkgs.org/search/?q=openssl



Kind regards,
--
Jochen Bern
Systemingenieur

Binect GmbH

CentOS 7 does not come with 3.0 versions of OpenSSL. (Not even available from oft-used repos like EPEL, if I understand correctly, unlike with CentOS 8.) If you installed it some other way, that "other way" would define how to install updates ... or cleanly uninstall it so as to install a current version from a different source.

smime.p7s
Description: S/MIME Cryptographic Signature