OpenSSL update in Native files

[tnzeibig]

The last Native package to download is from Aut 2011, and is missing some critical OpenSSL updates.  Is there a timeframe when this would become available?  I need to find some way to upgrade to Openssl V0.9.8zb.

https://www.openssl.org/news/secadv_20140605.txt

Or is there a way I can just upgrade the OpenSSL Component.  It doesn't look like I can just copy it from the OPENSSL site, as that version is only 316kb,

Similarly, I'm not sure I can just copy it from Tomcat  where OpenSSL.exe is 1,594kb, dated June 5. 

Thoughts would greatly be appreciated.

Thanks,

Tom Z

[jfclere]

We don't update .org packages... What version of AS/EAP are you using?

Changing the OpenSSL.exe won't help you need to change the dll

[tnzeibig]

Hi, thanks for your reply.  We're using JBoss 5.1 EAP.

Would that be the tcnative-1.dll?

[jfclere]

You have to change the libeay.dll and ssleay32.dll  You should upgrade to 5.2.0 and get a supported version because there are a few CVEs in the one you are using.

[tnzeibig]

Thanks Jean-Frederic,   I've looked for libeay.dll and ssleay32.dll in my origiinal folders, but only have OpenSSL.exe and tcnative-1.dll files.

Any further thoughts on this?  Your help is greatly appreciated.

[jfclere]

Hm may be changing tcnative-1.dll is enough... I can't remember if it was linked statically with openssl libraires or not, sorry.