New OpenSSL Vulnerability

SAML for ASP.NET Core
1

A new OpenSSL vulnerability was published today and I’m unclear if it might affect my application that uses ComponentSpace’s SAML SSO library. The vulnerability relates to name constraint checking during certificate validation. See official description here - https://www.openssl.org/news/secadv/20221101.txt. Please advise.

2

We don’t directly or indirectly use OpenSSL so there shouldn’t be any impact.

3
[quote]
ComponentSpace - 11/1/2022
We don't directly or indirectly use OpenSSL so there shouldn't be any impact.

[/quote]

Thanks for the quick reply! So no concerns about validating certs that were created using OpenSSL either?
4

No. I don’t believe so. This buffer overrun bug was in the OpenSSL code and is specific to their implementation.

We’re waiting to see if there are any announcements from Microsoft.

What operating system(s) are you using for your deployments?

5
[quote]
ComponentSpace - 11/1/2022
No. I don't believe so. This buffer overrun bug was in the OpenSSL code and is specific to their implementation.

We're waiting to see if there are any announcements from Microsoft.

What operating system(s) are you using for your deployments?
[/quote]

Certs were created in a Windows desktop environment. Application is deployed on Ubuntu.
6

I suggest checking that Ubuntu isn’t using a vulnerable version of OpenSSL.