OpenSSL version and CVE-2020-1967

[pichman]

Hi,

someone know wich version of openssl is on fortinet 6.2.X and if it is impacted by CVE-2020-1967 ?

Thanks

[kphed]

We asked our TAM about this and received a very generic answer and they would not even provide the version of OpenSSL used 'under-the-hood' stating "proprietary reasons".  We are awaiting an additional update.

[Benny_Lyne_Amorsen]

For at least FortiClientMac, we are in luck. The included OpenSSL is too old to be affected:

2020-04-20 17:53:51: INFO: @(#)This product linked OpenSSL 1.1.1b  26 Feb 2019 ([link]http://www.openssl.org/)[/link]

Whether that is reassuring obviously depends on your mindset :)