[Q&A] OpenSSL update

[yignor]

Documentation & bug reporting acknowledgment

Yes, I read it

Describe your problem

Service of infosecurity in my company see the problem in OpenSSL
• Version: 1.1.1i C:\Program Files\GLPIAgent\perl\vendor\lib\auto\Net\SSLeay
CVE: CVE-2022-1292
it's fixed in 1.1.1o, how can I update OpenSSL in GLPI Agent? Or it's need to do in source file?

[g-bougard]

I still have answered in #310 about OpenSSL update on windows build.
About CVE-2022-1292, following your link, it talks about the c_rehash script which is not embedded in GLPI Agent windows packaging. So this CVE is not concerning GLPI-Agent afaik.

[g-bougard]

Hi @yignor

I worked on the packaging building process so we can include our chosen libraries. From now, we will include OpenSSL 3.2.1. You still can validate it with the latest nightly build is you want.

[g-bougard]

Latest 1.8 release is now including OpenSSL 3.2.1 on windows.