What is OpenSSL 3.x vulnerability?   

On October 25, the OpenSSL Project announced a critical vulnerability that will be patched on November 1st. This is the second-most severe vulnerability of the OpenSSL project to date. The open SSL project team has also announced the release of a minor version that will be available on November 1st, 2022, which patches the critical vulnerability with disclosure of the vulnerability.

Why is the OpenSSL 3.0 vulnerability so critical, and how does it compare to other vulnerabilities like log4j or heartbleed?

Like the Heartbleed and Log4j vulnerabilities before it, the OpenSSL 3.0 vulnerability is critical because it is nested in a lot of systems and libraries. OpenSSL is included in many operating systems, web apps, vendor software and appliances, industrial control systems, and so on. This makes it difficult to patch all instances of the vulnerability, as they are scattered across many different platforms.

How to risk assess OpenSSL 3. x vulnerability?

The log4j vulnerability is not as severe as it used to be, thanks to our industry’s improved risk-assessment skills. We now know how to handle nested dependencies and can assess the threats posed by various exploitation methods. Furthermore, we can create mitigation strategies for code bases managed by organizations and vendor products. These same principles should apply when working on openssl 3.x mitigation efforts.

How prancer can help?

1. Prancer will autonomously create a list of all the cloud apps in your accounts that have OpenSSL installed.
2. By taking into account which critical assets have internet access or a VPN gateway, Prancer is able to automatically baseline the risk score and expose any vulnerable apps to users.
3. Prancer quickly assesses the WAF policy breakthroughs accomplished by the CSPs and validates them in real-time. This will work perfectly as a contingency plan for apps where immediate mitigations aren’t possible.
4. Prancer continuously checks and re-validates for app vulnerabilities in real-time, ensuring that the various mitigations work inside and outside networks.