search

jeroen / openssl

OpenSSL bindings for R
Other
65 stars 23 forks source link

vulnerability reported in the openssl.so library 3.0.13 #127

Open zoltickb opened 2 weeks ago

zoltickb commented 2 weeks ago

Is it possibility to build the openssl R package with a later version of the openssl library. Tenable is reporting a vulnerability with the 3.0.13 release.

OpenSSL 3.0.0 < 3.0.15 Vulnerability

I installed the R openssl 2.2.2 package under R 4.4.2 but the openssl library is still at version 3.0.13.

/usr/lib/R/library/openssl/libs# Rlist.R | grep openssl openssl 2.2.2

/usr/lib/R/library/openssl/libs# strings openssl.so | grep 3.3 OpenSSL 3.0.13 30 Jan 2024

Brad Zoltick Email: zoltickb@mail.nih.gov

jeroen commented 2 weeks ago

Which operating system are you using? On Linux, libssl is provided by your operating system, not by the R package.