A note about the bundled OpenSSL in the Windows SP

[Cantor, Scott]

Since I've been getting repeated questions about it at security at shibboleth.net, let me address this more broadly with a brief FAQ, which I'll eventually get into the wiki somewhere.

Q. Is the version of OpenSSL included with the SP on Windows maintained by the project?
A. Yes.

Q. What is the official project commitment to maintaining it?
A. When a vulnerability is discovered that impacts the use of the SP software, a patch is issued and the installer for the current version updated to include the patched version for new installations. This has happened at least twice in the last year or so, since the V2.5.3 release.

Q. Is the OpenSSL version at present in V2.5.3 subject to vulnerabilities?
A. Yes, but those vulnerabilities do not seriously impact the operation of the SP, they're more general issues with the OpenSSL software. If they impacted the SP, a patch would have been issued (see previous question).

Q. Why isn't a patch issued every time an OpenSSL update is issued?
A. Because everything takes time, and we have to prioritize where we spend that time. And at present there is no community assistance in the packaging and maintenance of the software. As long as that remains true, it's going to be up to my discretion whether I take the time to do a patch or not. Since any vulnerabilities are usually public knowledge, I'm happy to debate the urgency of an issue on the mailing list. The same answer applies to every library we bundle.

Q. But my security scans keep flagging this as an issue. How can I fix it?
A. Our security scans here complain that I have self-signed certificates used on my IdP too. Scans don't understand the context for what they report, that's why they can be informed about false positives.

Q. Is there any risk of the out of date version being used in some other software running on the server?
A. Essentially none. I build all the libraries using conventions that embed the ABI version of the library into the DLL and module names, because that's how they should be built. Nobody else that I'm aware of does this, so the versions bundled with the SP are essentially impossible to use in place of the versions provided with other software and don't overlap.

Q. Is a new version of the SP coming soon with an updated version of OpenSSL?
A. Yes, V2.5.4 will be released within weeks and includes OpenSSL 1.0.2 among other updates. Our work plan is maintained in the wiki (https://wiki.shibboleth.net/confluence/display/DEV/Work+Plan).

-- Scott