Question

What Version of OpenSSL is part of your latest release of FlexNet Embedded?

Answer

This is covered in the disclosure documentation included with each release in the Flexera/Revenera Product and License Center.

For example, the version of OpenSSL used in FlexNet Embedded 2014 R2 (2014.09) is 1.0.1h. For FlexNet Embedded 2017 R1, the version of Open SSL used is 1.0.2j.

Additional Information

In February, 2017, OpenSSL released security patch "OpenSSL version 1.1.0e, as described in OpenSSL Releases Security Update.

However, please note that 1.0.2 is not effected by this issue, as seen below.

OpenSSL Security Advisory [16 Feb 2017]
====================================================
Encrypt-Then-Mac renegotiation crash (CVE-2017-3733)
====================================================
Severity: High

During a renegotiation handshake, if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa), then this can cause OpenSSL to crash (dependent on ciphersuite). Both clients and servers are affected.

OpenSSL 1.1.0 users should upgrade to 1.1.0e.

NOTE: This issue does not affect OpenSSL version 1.0.2.