What is the plan for OpenSSL in future UE versions?

Development Programming & Scripting
, ,
1

It appears that in 5.6, OpenSSL 1.1.1t is still used. https://openssl-corporation.org/post/2023-09-11-eol-111/ states that OpenSSL’s 1.1.1 branch is end-of-life and is no longer receiving publicly available security fixes as of nearly two years ago, and https://openssl-library.org/news/vulnerabilities-1.1.1/ indicates that there are 14 published CVEs for this version of OpenSSL.

What are Epic’s plans regarding versions of OpenSSL in future versions Of UE, please? We would ideally like to see UE quickly move onto a currently supported version of OpenSSL such as 3.5, which is an LTS version and will be supported until 2030 according to https://openssl-library.org/roadmap/index.html .

2

Hi,

We are aware of 1.1.1 coming to an end, and we do have an internal task to upgrade to the latest version. However, I can’t provide any estimate as to when that update may happen, so we do recommend projects update their version locally if needed.

Thanks,

Alex

3

Hi,

Interesting.
It’s been a year, now since this last post.

  • What is the current update / advance on this matter ?
  • What is the best scenario to go on if we need encryption, considering 1.1.1 is now EOL ?

I want to make sure the route that i would start on isn’t flawed or obsolete from the start.
Since you say to update openssl versions locally, i assume it’s an easy task ? …

I am actually stuck on that encryption with my team, and that’s quite a headache.

Thanks.