Back

There’s a high severity flaw in OpenSSL - CVE-2024-12797

- it only applies to OpenSSL 3.2 or above, which in enterprises won’t be most things

- the feature in question isn’t enabled by default

- it’s potential attacker in the middle traffic inspection, not RCE

- clients can still spot the issue if well coded

So, for vast majority of orgs it will not be a drop everything to patch situation

https://openssl-library.org/news/secadv/20250211.txt