Skip to content
Search to learn about InterSystems products and solutions, career opportunities, and more. Results include content from our developer community, product documentation and education websites in addition to InterSystems.com.

Advisory: OpenSSL Security Advisory

June 17, 2014 - Advisory: OpenSSL Security Advisory

The OpenSSL Project https://www.openssl.org recently released a security advisory on vulnerabilities in the OpenSSL product.

These vulnerable OpenSSL products are included in the distribution of and used by most InterSystems products from version 2007.1 through the present, 2014.1. OpenVMS and Mac OSX are the exceptions to this; InterSystems products on these platforms use the libraries installed with the operating system.

InterSystems strongly recommends that customers move to OpenSSL versions containing the corrections to the vulnerabilities as soon as possible. To ease this transition for our partners, InterSystems is taking the following steps:

  1.  We have posted updated distributions of the latest maintenance release of all versions since 2011.1. The updated distributions include the corrected version of OpenSSL.
  2. We have posted versions of the corrected OpenSSL libraries, again for all versions since 2011.1, along with instructions that will install them in existing deployments. The list below shows the compatibility between corrected OpenSSL version and InterSystems version.
    OpenSSLInterSystems
    1.0.0m2011.1 through 2014.1
    0.9.8za 2007.1 through 2010.2

Installation of InterSystems products can result in OpenSSL libraries being placed in multiple locations. For example, the CSP Gateway uses SSL and the Gateway is often installed on a server separate from the primary InterSystems installation. The installation instructions detail the locations that need to be considered.

Distributions and instructions can be found at:
https://wrc.intersystems.com/wrc/Distribution.csp

Installation instructions are named: openssl_installation_instructionspatch-all.txt

Distributions of updated libraries are named according to the convention: openssl-version-platform.extension; for example, “openssl-2014.1.1.702.1-lnxsuse10x64.tar.gz”.

Note that distribution files are named for the most recent ISC maintenance release for a major version. These distributions are compatible with all releases for that major version. i.e. 2011.1.6.1001.4 is compatible with 2011.1.0 through 2011.1.6
If you have any questions regarding this advisory, please contact the  Worldwide Response Center.

Latest Alerts & Advisories

Sign Up Today

Receive notifications on support alerts, critical issues,
fixes, and product releases.
*Required Fields
Highlighted fields are required
*Required Fields
Highlighted fields are required
By submitting this form, you give consent to receive notifications concerning support alerts, critical issues, important updates, fixes, and product releases via email. In addition, you consent to your business contact information being entered into our CRM solution that is hosted in the United States, but maintained consistent with applicable data protection laws.
**By clicking here, you give consent to be contacted for news, updates and other marketing purposes related to existing and future InterSystems products, offerings, and events.