Summary

Which version of OpenSSL is used with FlexNet Publisher?

Question

Which version of OpenSSL is used with FlexNet Publisher?

Answer

For FNP 11.12.1, the OpenSSL version used was 1.0.1e. For FlexNet Publisher 11.13.1, the OpenSSL version used was 1.0.1h. In FlexNet Publisher 11.13.1, it got upgraded to 1.0.1j. And, for FlexNet Publisher 11.14, the OpenSSL version remained at 1.0.1j.

If in doubt, a command like:

strings lmadmin.exe | findstr /I /C:"openssl 1."

tends to find the version nicely. Substitute grep for findstr on non-windows.

Additional Information

In lmadmin we dynamically link to OpenSSL, but in FNPCommsSoap.so and libFNP.so we statically link to OpenSSL. lib FlexNet Publisher uses only crypto algorithms, no over-the-wire components, that is it has a dependency on libcrypto, but not on libssl.

So lmadmin can receive updates at the 1.0.x level by the producer updating libcrypto.so.1.0.0 and libssl.so.1.0.0, but libFNP.so and FNPCommsSoap.so would have to be rebuilt by Flexera.

We routinely upgrade OpenSSL in releases. 11.14.1.0 uses 1.0.2h. Next upgrade (in 11.15.0.0) is currently targeted to be to 1.0.2j - refer FNP-15814. We would only do a major version increase in the event that the current version is about to lose security-vulnerability update support. Quoting from https://www.openssl.org/source/

Also available is the 1.0.2 series. This is also our Long Term Support (LTS) version (support will be provided until 31st December 2019)