OpenSSL vulnerabilities showing in Defender Dashboard

Question

We have multiple devices showing up with OpenSSL vulnerabilities. It is detecting two dll files that it is flagging. Which they are libssl-3-x64.dll and libcrypto-3-x64.dll. It is flagging this for multiple different applications through out multiple devices. Some devices it's not the same application. Is defender showing a false negative of these vulnerabilities. If this are not false negatives then what is the process to update the dll files inside the applications?

Answer 1

@Givary-MSFT i have the same problem on our defender portal and can't be updated openssl in window apps please find below the screenshot

i think this is wrong recommendation

Answer 2

In some product groups, there seems to be a misunderstanding about such an issue: Sometimes it's not about "does this vulnerability affect me?", but "how can I trust my security reporting?". Without updating the product to use the current version of openssl, I simply cannot install it any more on any of our devices. Also, Microsoft gets blamed for that, because they are deploying vulnerable code to our computers (it is completely unimportant whether the code is being used or not - it is there). Our security reporting is based on Defender Vulnerability Management. So, in this case Microsoft tells us to NOT use this software until it gets an update - in this case SSMS from Microsoft. PLEASE: when there is a vulnerability in a library you use: do NOT try to find out whether it will affect you or not - simply update. There is no legitimation for a known vulnerable library on a computer other than that there is currently no updated library available. But in this case, there is: simply update the library in your product.

Answer 3

I have the same problem, however with different applications. Like Zoom and even some drivers showing up in this report. Has MS released a fix or answer for this yet?

Answer 4

We're experiencing the same issue on our domain. Lots of these are in driver folders, updated in the last six months.

Answer 5

There is a similar issue with AutoDesk DWG Trueview (ADODIS).

c:\program files\autodesk\adodis\v1\setup\cer\libcrypto-3-x64.dll (v3.0.13) generates a notification within the Defender Portal.

I have upgraded to Trueview 2025, and this has updated the above dll to v3.0.14. I don't know if this will resolve the OpenSSL warning in Defender though.