EPICS Home EPICS Controls Argonne National Laboratory

Experimental Physics and
Industrial Control System

Format page
for printing


Search Tech-talk
1994  1995  1996  1997  1998  1999  2000  2001  2002  2003  2004  2005  2006  2007  2008  2009  2010  2011  2012  2013  2014  2015  2016  2017  2018  2019  2020  2021  2022  2023  <2024>  Index 1994  1995  1996  1997  1998  1999  2000  2001  2002  2003  2004  2005  2006  2007  2008  2009  2010  2011  2012  2013  2014  2015  2016  2017  2018  2019  2020  2021  2022  2023  <2024> 
<== Date ==> <== Thread ==>
Subject: Re: [EXTERNAL] OpenSSL vulnerability epics
From: "Hartman, Steven via Tech-talk" <tech-talk at aps.anl.gov>
To: "Hermann, Raphael P." <hermannrp at ornl.gov>
Cc: "tech-talk at aps.anl.gov" <tech-talk at aps.anl.gov>
Date: Fri, 26 Jan 2024 15:35:56 +0000
Based on your file path, the library is part of an add-on extension, not part of EPICS base. You will need to determine which extension has been added locally that is providing the library and address that. 

-- 
Steven Hartman
hartmansm at ornl.gov



On Jan 26, 2024, at 10:29 AM, Hermann, Raphael P. via Tech-talk <tech-talk at aps.anl.gov> wrote:

Dear colleagues,
 
I’m running epics on a lab computer and ORNL IT safety flags a few vulnerabilities related to OpenSSL:
/opt/epics/extensions/lib/linux-x86_64/libcrypto.so.1.1 Reported version : 1.1.1 Fixed version : 1.1.1a
/opt/epics/extensions/lib/linux-x86_64/libcrypto.so.1.0.0 Reported version : 1.0.1d Fixed version : 1.0.1g
 
 
I’ve recompile the latest base distribution after updating OpenSSL, but it seems this library is not pulled from the system.
 
Do you have any advice on patching this?

Thanks
Raphael Hermann
 
 
-- 
Raphaël P. Hermann (he/him/his)
Senior Researcher
Neutron and X-ray Scattering Group
Materials Science and Technology Division
Oak Ridge National Laboratory
Bldg. 4515, Rm. 233, MS-6064
1, Bethel Valley Rd*
Oak Ridge, TN 37831-6064    USA 
Phone: 865-576-4264
 
*Valid for package delivery. // For USPS service only: Replace with P.O. Box 2008

References:
OpenSSL vulnerability epics Hermann, Raphael P. via Tech-talk
Navigate by Date:
Prev: Re: OpenSSL vulnerability epics Johnson, Andrew N. via Tech-talk
Next: Re: OPC UA build problem Knap, Giles (DLSLtd,RAL,LSCI) via Tech-talk
Index: 1994  1995  1996  1997  1998  1999  2000  2001  2002  2003  2004  2005  2006  2007  2008  2009  2010  2011  2012  2013  2014  2015  2016  2017  2018  2019  2020  2021  2022  2023  <2024> 
Navigate by Thread:
Prev: Re: OpenSSL vulnerability epics Johnson, Andrew N. via Tech-talk
Next: Re: OpenSSL vulnerability epics Michael Davidsaver via Tech-talk
Index: 1994  1995  1996  1997  1998  1999  2000  2001  2002  2003  2004  2005  2006  2007  2008  2009  2010  2011  2012  2013  2014  2015  2016  2017  2018  2019  2020  2021  2022  2023  <2024> 
ANJ, 26 Jan 2024 Valid HTML 4.01! · Home · News · About · Base · Modules · Extensions · Distributions · Download ·
· Search · EPICS V4 · IRMIS · Talk · Bugs · Documents · Links · Licensing ·