Advisory 2021-05/1 OpenSSL Vulnerability

CA Certificate Check Bypassed

Security Advisory Date	May 5, 2021
Vulnerability Type	Component with Known Vulnerability
Severity factors	See https://www.openssl.org/news/secadv/20210325.txt
Versions affected	All versions of FileCloud prior to 21.1.0.15081.
Version fixed	FileCloud Version 21.1.0.15081

Description

OpenSSL versions 1.1.1h and newer introduced an error that enabled bypassing a security check. The security check would have confirmed that non-CA certificates could not issue other certificates. OpenSSL 1.1.1k fixes this issue.

The latest version of FileCloud includes the updated version of OpenSSL, 1.1.1k.

See the full descriptions of the issue at https://www.openssl.org/news/secadv/20210325.txt.

Fix

This has been fixed in FileCloud version 21.1.0.15081, which includes the updated version of OpenSSL.

What you should do

If you are using a FileCloud on-premises installation, please update it to the latest version, which is 21.1.0.15081 or greater.
If you are using FileCloud online, your site has already been updated to the latest version.

If you have any questions about this advisory, please contact FileCloud support.