marc
July 2, 2024, 4:55pm
8
Hi @alberto ,
I believe the solution here is to provide your own SSL libraries as part of your build and add them tot he LD_LIBRARY_PATH. The API will load the TLS libraries found on LD_LIBRARY_PATH first and only resort to loading the libraries co-located with libsolclient.so as a backup.
Note from docs in supported environment:
Note that this was recently discussed in a github issue as well that has some more context:
opened 04:08PM - 07 May 24 UTC
closed 04:55PM - 02 Jul 24 UTC
bug
### Bug Description
All project referencing SolaceSystems.Solclient.Messaging 1… 0.22+ version of your lib are vulnerable to CVE-2022-4450.
Is it possible to upgrade underlying packages ?
### Expected Behavior
No CVE issues raised
### Steps to Reproduce
run following commands:
`dotnet new webapi`
`dotnet add package SolaceSystems.Solclient.Messaging`
`dotnet publish`
Then check in `bin\Release\net9.0\runtimes\linux-x64\native` the `libssl.so` file version.
The version 1.1 is vulnerable.
PS: to check version you can use `readelf -d libssl.so | grep SONAME` in linux (or WSL)
### Solace Product
Other
### Solace Broker version
LATEST
### Solace API
10.22-10.24
### Solace API version
10.22-10.24
Hope that helps!