topic Re: Critical OpenSSL Vulnerability in Management & Governance

Critical OpenSSL Vulnerability

BernieMaf — Fri, 14 Feb 2025 05:36:38 GMT

Good day

When should we expect the release of QB-28631 or QB-28762, now we are sitting with a situation (https://cyberpress.org/openssl-vulnerability/) and Microsoft Defender has picked up Qlik Sense's OpenSSL files need to be updated.

Affected Files:

c:\program files\common files\qlik\custom data\qvodbcconnectorpackage\drill\lib\openssl64.dlla\libcrypto-3-x64.dll
c:\program files\common files\qlik\custom data\qvodbcconnectorpackage\drill\lib\openssl64.dlla\libssl-3-x64.dll

c:\programdata\package cache\af7aeebf-6f94-4a09-9113-21295ed47105\qvodbcconnectorpackage\oracle\lib\libcrypto-3-x64.dll
c:\programdata\package cache\af7aeebf-6f94-4a09-9113-21295ed47105\qvodbcconnectorpackage\oracle\lib\libssl-3-x64.dll
c:\programdata\package cache\af7aeebf-6f94-4a09-9113-21295ed47105\qvodbcconnectorpackage\spark\lib\libcurl64.dlla\openssl64.dlla\libcrypto-3-x64.dll

c:\programdata\package cache\af7aeebf-6f94-4a09-9113-21295ed47105\qvodbcconnectorpackage\spark\lib\libcurl64.dlla\openssl64.dlla\libssl-3-x64.dll
c:\programdata\package cache\af7aeebf-6f94-4a09-9113-21295ed47105\qvodbcconnectorpackage\spark\lib\openssl64.dlla\libcrypto-3-x64.dll
c:\programdata\package cache\af7aeebf-6f94-4a09-9113-21295ed47105\qvodbcconnectorpackage\spark\lib\openssl64.dlla\libssl-3-x64.dll

cc: @Lass

Re: Critical OpenSSL Vulnerability

BernieMaf — Wed, 19 Feb 2025 08:27:42 GMT

@Nick_Asilo can you please assist?

Re: Critical OpenSSL Vulnerability

tin_u — Wed, 02 Apr 2025 12:25:42 GMT

Do we have any status on this that Qlik recognize this as an issue?

Re: Critical OpenSSL Vulnerability

BernieMaf — Wed, 02 Apr 2025 12:43:11 GMT

Nothing at all.
QLIK support is non-existent on issues we raise. I guess they are willing to pay when we get breached because of their products.
Security is not that important to them, postmen are quicker than their security team when it comes to delivery.

Re: Critical OpenSSL Vulnerability

tin_u — Thu, 03 Apr 2025 14:31:31 GMT

Just got a reply from support regarding my ticket where i raised some of these concerns, and it seems like these issues will be addressed in the May 2025 Initial Release..

Re: Critical OpenSSL Vulnerability

BernieMaf — Thu, 03 Apr 2025 14:35:11 GMT

I won't get my hopes up. We were told last year that it would be addressed in the November 2024 release, but here we are.

Re: Critical OpenSSL Vulnerability

tin_u — Mon, 07 Apr 2025 08:40:37 GMT

Fair enough.. lets cross our fingers i guess..

Re: Critical OpenSSL Vulnerability

BernieMaf — Mon, 07 Apr 2025 08:53:45 GMT

I have already gone through the Technical Preview for May 2025 https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-Technical-Preview-for-May-2025/ta-p/2512973 and I don't see the resolution for our issue.
The only thing close to our issue is the QB-29866 (Qlik Sense: libcurl library updates).