Which version of OpenSSL is used with FNP?

[#1]

Summary

Which version of OpenSSL is used with FlexNet Publisher?

Question

Which version of OpenSSL is used with FlexNet Publisher?

Answer

For FNP 11.12.1, the OpenSSL version used was 1.0.1e. For FNP 11.13.1, the OpenSSL version used was 1.0.1h. In FNP 11.13.1, it got upgraded to 1.0.1j. And, for FNP 11.14, the OpenSSL version remained at 1.0.1j.

If in doubt, a command like
strings lmadmin.exe | findstr /I /C:"openssl 1."
tends to find the version nicely. Substitute grep for findstr on non-windows.

Additional Information

In lmadmin we dynamically link to OpenSSL, but in FNPCommsSoap.so and libFNP.so we statically link to OpenSSL. libFNP uses only crypto algorithms, no over-the-wire components, that is it has a dependency on libcrypto, but not on libssl.

So lmadmin can receive updates at the 1.0.x level by the producer updating libcrypto.so.1.0.0 and libssl.so.1.0.0, but libFNP.so and FNPCommsSoap.so would have to be rebuilt by Flexera.

We routinely upgrade OpenSSL in releases. 11.14.1.0 uses 1.0.2h. Next upgrade (in 11.15.0.0) is currently targeted to be to 1.0.2j - refer FNP-15814. We would only do a major version increase in the event that the current version is about to lose security-vulnerability update support. Quoting from https://www.openssl.org/source/

Also available is the 1.0.2 series. This is also our Long Term Support (LTS) version (support will be provided until 31st December 2019)