Native cloud deployment on Azure is not available for this version of Exasol, but you can install Exasol as a Linux application on Azure instances. For more information, see Installation.

Native cloud deployment on Google Cloud is not available for this version of Exasol, but you can install Exasol as a Linux application on Google Cloud instances. For more information, see Installation.

SECURITY: Windows ODBC driver is affected by OpenSSL bug

Details

Detail name	Value
Changelog Number	15823
Type	Bug
Status	Resolved
Affected Versions	Exasol 7.1.0
Fix Versions	Exasol 7.1.16
Resolution Date	2022-11-24

Description

Recently it was announced that due to a bug in some OpenSSL versions a buffer overrun can be triggered in X.509 certificate verification.
Our 7.1 Windows ODBC driver is using one of the affected OpenSSL versions.

Details on the OpenSSL vulnerability can be found here:
https://nvd.nist.gov/vuln/detail/CVE-2022-3786
https://nvd.nist.gov/vuln/detail/CVE-2022-3602

Workaround

There are several options:

Use the fingerprint to establish a connection
Set SSLCERTIFICATE to SSL_VERIFY_NONE to use a secure TLS connection but without validating the certificate
Set LegacyEncryption to Y to fallback to ChaCha encryption instead of TLS

Fix

The Windows ODBC driver is using a new OpenSSL version that is not affected by this vulnerability.

SECURITY: Windows ODBC driver is affected by OpenSSL bug

Details

Description

Workaround

Fix

PRODUCT

RESOURCES