Vulnerable OpenSSL bundled

[Felipe Morais]

The following DLLs used by Calibre 7.x (Windows) are being flagged by MS Defender for Endpoint as vulnerable:

libssl-3.dll
libcrypto-3.dll
libssl-3-x64.dll
libcrypto-3-x64.dll

I assume they come from OpenSSL 3.1.14. This version is vulnerable to a series of CVEs fixed in version 3.3 of OpenSSL. I`d like to suggest updating OpenSSL dependencies for Calibre in a future release as soon as possible to avoid those vulnerabilities.

Changelogs: https://www.openssl.org/news/cl33.txt

[Kovid Goyal (kovid)]

None of those CVEs are applicable to calibre's usage of OpenSSL as far
as I can tell, however I will update to 3.1.5 (it is currently at 3.1.3)
for the next calibre release to avoid the security theatre.

[Kovid Goyal (kovid)]

Fixed in branch master. The fix will be in the next release. calibre is usually released every alternate Friday.

[Felipe Morais (fdemenes)]

Any 3.1.X versions would not avoid the detection by common Anti Virus. Version 3.3 and higher would do that. Thanks for your prompt response!

[Kovid Goyal (kovid)]

3.1 is actively maintained as far as I know. If there are outstanding
issues with it it should be reported to openssl so they can make a patch
releas ein 3.1. And if there arent then the false detection should be
reported to the antivirus vendor.