# OpenSSL bug

**URL:** <https://ifnotnil.com/t/openssl-bug/2594>\
**Category:** General Programming\
**Created:** [7 July 2022 05:43 UTC](https://ifnotnil.com/t/openssl-bug/2594 "2022-07-07T05:43:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![MarkusWinter](https://ifnotnil.com/user_avatar/ifnotnil.com/markuswinter/32/32_2.png) [@MarkusWinter](https://ifnotnil.com/u/MarkusWinter)\
**Post date:** [7 July 2022 05:43 UTC](https://ifnotnil.com/t/openssl-bug/2594/1 "2022-07-07T05:43:07Z")

</div>

Those using OpenSSL version 3.0 [should update](https://www.openssl.org/news/cl30.txt) to **3.0.5**.

Those using OpenSSL version 1.1.1 [should update](https://www.openssl.org/news/cl111.txt) to **1.1.1q**.

See [OpenSSL fixes two “one-liner” crypto bugs – what you need to know – Naked Security](https://nakedsecurity.sophos.com/2022/07/06/openssl-fixes-two-one-liner-crypto-bugs-what-you-need-to-know/)

What options are there for those still using older Xojo versions?

---

<div class="post-metadata">

**Author:** ![MonkeybreadSoftware](https://ifnotnil.com/user_avatar/ifnotnil.com/monkeybreadsoftware/32/451_2.png) [@MonkeybreadSoftware](https://ifnotnil.com/u/MonkeybreadSoftware)\
**Post date:** [7 July 2022 11:06 UTC](https://ifnotnil.com/t/openssl-bug/2594/2 "2022-07-07T11:06:43Z")

</div>

I am recompiling my stuff today with the openssl update.

---

<div class="post-metadata">

**Author:** ![Tim](https://ifnotnil.com/user_avatar/ifnotnil.com/tim/32/13_2.png) [@Tim](https://ifnotnil.com/u/Tim)\
**Post date:** [7 July 2022 13:41 UTC](https://ifnotnil.com/t/openssl-bug/2594/3 "2022-07-07T13:41:39Z")

</div>

The Crypto module doesn’t offer OCB mode so one of the bugs you don’t have to worry about. The other I don’t know enough about to speak on.

Xojo developer options include:

- Developers using exclusively Xojo will have to [file a ticket and wait for an update](https://xojo.com/issues)
- Developers using plugins that bundle OpenSSL should [check for new versions](https://strawberrysw.com/plugins-pro/)
- Developers bundling OpenSSL will have to rebuild it

Hope this helps.

---

<div class="post-metadata">

**Author:** ![thommcgrath](https://ifnotnil.com/letter_avatar_proxy/v4/letter/t/ec9cab/32.png) [@thommcgrath](https://ifnotnil.com/u/thommcgrath)\
**Post date:** [7 July 2022 14:55 UTC](https://ifnotnil.com/t/openssl-bug/2594/4 "2022-07-07T14:55:22Z")

</div>

Xojo’s Crypto module is built on [Crypto++](https://www.cryptopp.com), not OpenSSL. I believe their SSLSocket uses it though. As for updating older versions, you can’t. You’ll need to switch to third-party options, such as MBS.

---

<div class="post-metadata">

**Author:** ![npalardy](https://ifnotnil.com/user_avatar/ifnotnil.com/npalardy/32/10_2.png) [@npalardy](https://ifnotnil.com/u/npalardy)\
**Post date:** [7 July 2022 15:02 UTC](https://ifnotnil.com/t/openssl-bug/2594/5 "2022-07-07T15:02:37Z")

</div>

MBS ?

however if things like postgresql etc use OpenSSL then only Xojo can update those