New OpenSSL releases 3.5.1, 3.4.2, 3.3.4, 3.2.5 and 3.0.17 and new resource files linked by ICS

[Angus Robertson 656]

OpenSSL has issued new releases of all the currently supported versions, 3.5.1, 3.4.2, 3.3.4, 3.2.5 and 3.0.17.

 

OpenSSL 3.5.1 fixes a low risk CVE-2025-4575 relating to use of a command in the openssl.exe application to use trusted certificates.  All releases include periodic miscellaneous minor bug fixes.

 

Windows binaries are available in SVN and the overnight zip file and separately from https://wiki.overbyte.eu/wiki/index.php/ICS_Download or https://www.magsys.co.uk/delphi/magics.asp

In addition to the three DLL files, the zips include compiled RES resource files that contain the same DLLs, text files and version information, see the RC file. The RES file may be linked into application EXE files and code then used to extract the DLLs from the resource to a temporary directory to avoid distributing them separately.

 

ICS V9.1 and later optionally support loading the resource files.

 

These OpenSSL versions are included with ICS V9.5 beta available from SVN and the overnight zip.

 

ICS V9.5 beta now defaults to using OpenSSL 3.5.1, provided the new OverbyteIcsDefs.inc files is installed, or you undefine OpenSSL_35 and suppress an earlier version.

 

The SSL/TLS Certificate Authority Root Stores bundles have also been updated with new roots, more information at https://wiki.overbyte.eu/wiki/index.php/FAQ_SSL/TLS_Certificate_Authority_Root_Stores and downloads at: https://www.magsys.co.uk/download/software/ca-root-bundles.zip and are already included with ICS V9.5 beta.

 

Separately, https://www.yunqa.de/ has released 3.0.17, 3.3.4 and 3.4.2 as commercial DCUs allowing applications to be used with OpenSSL without needing separate DLLs.

 

Angus