OpenSSL Vulnerability - Zoom Meetings uses old version 3.1.1 | Community
Skip to main content
L
Newcomer
lcchelpdesk
Newcomer
November 26, 2023
Solved

OpenSSL Vulnerability - Zoom Meetings uses old version 3.1.1

  • November 26, 2023
  • 32 replies
  • 1 view

I raised this on the dev forum hoping it would have reached the right set of eyes.

https://devforum.zoom.us/t/zoom-5-6-10-vulnerabilities-with-openssl-dll-need-version-3-1-5/98806/1

 

However, following a Search all prior reports of vulnerabilities have been placed within Zoom Community.

 

Using Zoom Meetings Client 5.16.10 (26186)
Microsoft Defender flags as vulnerable for
CVE-2023-4807 CVSS 6.2,
CVE-2023-5363 CVSS 5.9,
CVE-2023-3817 CVSS 3.7,
CVE-2023-5678 CVSS 3.7,

Install source: https://zoom.us/client/5.16.10.26186/ZoomInstallerFull.exe?archType=x64

Detected files
c:\program files\zoom\bin\libcrypto-3-zm.dll
c:\program files\zoom\bin\libssl-3-zm.dll
OpenSSL Version 3.1.1.0

Recommended course of action, upgrade to OpenSSL Version 3.1.5 or 3.2.0

Updating to 3.1.4 would still leave CVE-2023-5678


https://www.openssl.org/news/vulnerabilities.html

CVE-2023-4807, Fixed in OpenSSL 3.1.3 (Affected since 3.1.0)
gitcommit see git openssl org/gitweb/?p=openssl.git;a=commitdiff;h=4bfac4471f53c4f74c8d81020beb938f92d84ca5

CVE-2023-5363 , Fixed in OpenSSL 3.1.4 (Affected since 3.1.0)
gitcommit see git openssl org/gitweb/?p=openssl.git;a=commitdiff;h=5f69f5c65e483928c4b28ed16af6e5742929f1ee

CVE-2023-3817, Fixed in OpenSSL 3.1.2 (Affected since 3.1.0)
gitcommit see git openssl org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5

CVE-2023-5678 , Fixed in OpenSSL 3.1.5 (Affected since 3.1.0)
gitcommit see git openssl org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6

    Best answer by Frank_TB

    Hello,

     

    Release notes for December 27, 2023

     

    New and enhanced features

    • General features
      • Update to OpenSSL 3.1.4 - Linux, Android, iOS
        Due to the recently disclosed vulnerabilities with lower versions of OpenSSL, the Zoom client is updated to use OpenSSL 3.1.4. Depending on your network security configuration, you may also need to update your network infrastructure devices’ firmware.

        https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0073685 

    Regards,

     

    If my reply helped, don't forget to click the accept as solution button!

    32 replies

    C
    Newcomer
    CompblCPS
    Newcomer
    November 27, 2023

    Microsoft Defender 365 Vulnerability scans are showing every machine with 5.16.10 as vulnerable due to OpenSSL 3.1.1.1 use…

    Need to be updated to 3.1.5 or newer ASAP

      L
      Newcomer
      LCalrissian
      Newcomer
      November 28, 2023

      Thank you so much for pointing this out.  I am seeing this same issue.

       

      Disappointingly, Nessus vulnerability scanners are not picking up on this vulnerability 😞

        D
        Newcomer
        dbrowna2bf
        Newcomer
        November 28, 2023

        We have this vulnerability on almost every machine in our environment because Zoom seemingly doesn't care that their platform is vulnerable. I'm pretty disgusted, to say the least. I'll be using this example, and many others, to convince our CEO to let me migrate to Microsoft Teams instead.

          J
          Newcomer
          Jigsaw428
          Newcomer
          December 5, 2023

          Fact Check True ✅
          They need to have this updated ASAP

            O
            Newcomer
            OutWest
            Newcomer
            December 6, 2023

            This is not just Zoom.

            The Microsoft PowerBI Desktop client also has an out of date OpenSSL version as well as several other vendors.
            I tried to replace the out of date libssl-3-x64.dll and libcrypto-3-x64.dll across the machines in our domain, but Zoom signed their version of the dll files, and refuses to start with the updated dll files. Good for them for signing them, not something many other vendors do. On the flip side, they should have this patched and up to date already. 
            Microsoft's Cloud Defender agent for Linux (mdatp) is running a curl version that is showing as critical. Microsoft chooses to hide this on their vulnerability scans, Tenable found it.
            This is not just a Zoom problem, but an industry problem with these critical open source dependencies. 
             

              D
              Newcomer
              Dash1977
              Newcomer
              December 19, 2023

              Zoom 5.17 just released, but still has the 3.1.1 OpenSSL. I think we're just going to have to discontinue Zoom use and uninstall the app agency wide until it's resolved. 

                D
                Newcomer
                dbrowna2bf
                Newcomer
                December 19, 2023

                I really wish we could just drop Zoom, but my boss hates Teams so we are pretty much stuck with a vulnerability on every one of our workstations. At least it isn't on any of our servers, but the workstations connect to our servers... This bad.

                  L
                  Newcomer
                  lcchelpdeskAuthor
                  Newcomer
                  December 21, 2023

                  Tried the latest version and Using Zoom Meetings Client 5.17.0 (28375)
                  DisplayVersion 5.17.28375
                  Install source: https://zoom.us/client/5.17.0.28375/ZoomInstallerFull.msi?archType=x64

                   

                  I can confirm that this version still utilises OpenSSL Version 3.1.1.0
                  C:\Program Files\Zoom\bin\libcrypto-3-zm.dll
                  C:\Program Files\Zoom\bin\libssl-3-zm.dll

                    L
                    Newcomer
                    lcchelpdeskAuthor
                    Newcomer
                    December 28, 2023

                    Tried the latest version and Using Zoom Meetings Client 5.17.1 (28914) (64-bit)
                    DisplayVersion 5.17.28914
                    Install source: https://cdn.zoom.us/prod/5.17.1.28914/x64/ZoomInstallerFull.msi

                    I can confirm that this version still utilises OpenSSL Version 3.1.1.0
                    C:\Program Files\Zoom\bin\libcrypto-3-zm.dll
                    C:\Program Files\Zoom\bin\libssl-3-zm.dll

                      O
                      Newcomer
                      OutWest
                      Newcomer
                      January 3, 2024

                      Still an issue. Zoom, please get this updated with a current version of OpenSSL. If you are doing a custom patch to the version you are running and consider this OK, please don't. We have no way of verifying compliance and this throws off our necessary reporting and patch management. 

                      D
                      Newcomer
                      Dash1977
                      Newcomer
                      January 3, 2024

                      I had a meeting with our I.T. security team. We’re going to do a mass uninstall next week and instruct users to use the web only version from now on. 

                        F
                        Community Champion | Customer
                        Frank_TBAnswer
                        Community Champion | Customer
                        January 3, 2024

                        Hello,

                         

                        Release notes for December 27, 2023

                         

                        New and enhanced features

                        • General features
                          • Update to OpenSSL 3.1.4 - Linux, Android, iOS
                            Due to the recently disclosed vulnerabilities with lower versions of OpenSSL, the Zoom client is updated to use OpenSSL 3.1.4. Depending on your network security configuration, you may also need to update your network infrastructure devices’ firmware.

                            https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0073685 

                        Regards,

                         

                        If my reply helped, don't forget to click the accept as solution button!

                        Show more replies
                        Terms & ConditionsAccessibility statement
                        Copyright © Zoom Communications, Inc. All rights reserved.