OpenSSL critical fix: find your OpenSSL 3

A critical OpenSSL 3.0 fix lands on 1 November. Use the days before to find where you run version 3.

27 October 2022 · 1 min read

The OpenSSL project announced it will release version 3.0.7 on 1 November with a fix for a “critical” bug. That’s only the second critical rating in its history; the first was Heartbleed. Details come with the release.

Good news first: it only affects OpenSSL 3.0.x. Version 1.1.1, still the most common, isn’t affected.

Use the days before the release to find where you run OpenSSL 3:

Newer Linux releases such as Ubuntu 22.04 and RHEL 9 ship it.
Runtimes that bundle it, such as recent Node.js versions.
Container images built on those bases.
Your own builds that statically link it.

Check with openssl version on servers, and your software inventory for the rest. Then be ready to update on Tuesday, starting with anything facing the internet.

It may turn out less severe than feared. Finding your OpenSSL 3 is still useful work either way.