OpenSSL Vulnerability - Zoom Meetings uses old version 3.1.1

Forum|Forum|2 years ago
November 26, 2023
32 replies
38 views

I raised this on the dev forum hoping it would have reached the right set of eyes.

https://devforum.zoom.us/t/zoom-5-6-10-vulnerabilities-with-openssl-dll-need-version-3-1-5/98806/1

However, following a Search all prior reports of vulnerabilities have been placed within Zoom Community.

Using Zoom Meetings Client 5.16.10 (26186)
Microsoft Defender flags as vulnerable for
CVE-2023-4807 CVSS 6.2,
CVE-2023-5363 CVSS 5.9,
CVE-2023-3817 CVSS 3.7,
CVE-2023-5678 CVSS 3.7,

Install source: https://zoom.us/client/5.16.10.26186/ZoomInstallerFull.exe?archType=x64

Detected files
c:\program files\zoom\bin\libcrypto-3-zm.dll
c:\program files\zoom\bin\libssl-3-zm.dll
OpenSSL Version 3.1.1.0

Recommended course of action, upgrade to OpenSSL Version 3.1.5 or 3.2.0

Updating to 3.1.4 would still leave CVE-2023-5678

https://www.openssl.org/news/vulnerabilities.html

CVE-2023-4807, Fixed in OpenSSL 3.1.3 (Affected since 3.1.0)
gitcommit see git openssl org/gitweb/?p=openssl.git;a=commitdiff;h=4bfac4471f53c4f74c8d81020beb938f92d84ca5

CVE-2023-5363 , Fixed in OpenSSL 3.1.4 (Affected since 3.1.0)
gitcommit see git openssl org/gitweb/?p=openssl.git;a=commitdiff;h=5f69f5c65e483928c4b28ed16af6e5742929f1ee

CVE-2023-3817, Fixed in OpenSSL 3.1.2 (Affected since 3.1.0)
gitcommit see git openssl org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5

CVE-2023-5678 , Fixed in OpenSSL 3.1.5 (Affected since 3.1.0)
gitcommit see git openssl org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6

Meeting Features

Best answer by Frank_TB

Hello,

Release notes for December 27, 2023

New and enhanced features

General features
- Update to OpenSSL 3.1.4 - Linux, Android, iOS
  Due to the recently disclosed vulnerabilities with lower versions of OpenSSL, the Zoom client is updated to use OpenSSL 3.1.4. Depending on your network security configuration, you may also need to update your network infrastructure devices’ firmware.
  
  https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0073685

Regards,

If my reply helped, don't forget to click the accept as solution button!

Show previous replies

G

glatange

Employee

Hi All,

Please upgrade to Zoom client version client version 6.1.0 or higher. We upgraded to openSSL library 3.1.5 in May so openSSL is no longer an issue.

Similarly client version 6.1.0 and up avoids CVE-2023-5678. On the other hand, I have confirmed with security engineering that CVE-2024-2511 and CVE-2024-4603 have no impact on the Zoom client, but am looking into a formal communications response to provide more clarity for client users.

U

user16

Newcomer

You can put out a statement that says why those CVEs don't affect you, or you can patch the actual libraries so that you're not the #1 risky and vulnerable software in every security business scanning product and dashboard in use across the majority of the US. If your product is not vulnerable tell Microsoft to stop flagging it, until you do you will remain as the #1 vulnerable software in all the reporting as you have been for almost a year now.

Does Zoom not realize how bad of a look this is? You're literally giving people a reason to suggest moving to Teams.