search

genotrance / px

An HTTP proxy server to automatically authenticate through an NTLM proxy
MIT License
950 stars 98 forks source link

libcrypto-1_1.dll version 1.1.1q with vulnerabilites #197

Closed nziegler closed 9 months ago

nziegler commented 12 months ago

Our company security department has flagged the OpenSSL version in the folder of px 0.84 as vulnerability issue and recommends to upgrade to least 1.1.1w. The current dll is 1.1.1q.

Would it be possible to update the library?

There are several issues with medium to high severity after version 1.1.1q https://www.openssl.org/news/vulnerabilities-1.1.1.html

genotrance commented 11 months ago

I presume you are talking about the Windows ZIP. Considering it is made using Nuitka, it simply pulls in the OpenSSL versions in the Python distro I was using at the time of creation. For the near term, you could simply replace the file in the folder with a newer version and it should work. A slightly better alternative would be to use the wheels with an existing version of Python which is kept up to date. In that case, we will only be stuck with an older libcurl binary that is bundled with Px.

Meanwhile, I'm working on a new release of Px which hopes to leverage the embeddable version of Python instead of building Nuitka binaries and wrestling with virus scanners. Hopefully, we have fewer issues of that kind but will still have issues with those dlls going out of date over time.

genotrance commented 11 months ago

This is fixed in v0.9.0 still in development - see branch.

Px binaries for Windows will now be built using the Python Embedded binary instead of Nuitka. See tools.py embed() if curious. Will post binaries after development and test is complete.

nziegler commented 11 months ago

I replaced the dll with a newer version as you said, without problems. I will check the other setup options you have described in the readme. Thanks!

genotrance commented 9 months ago

v0.9.0 has been released.