On November 1, 2022, The OpenSSL Foundation released OpenSSL version 3.0.7. This release is a security-fix and addresses two “High” severity vulnerabilities, https://www.openssl.org/news/vulnerabilities.html. Advanced notice was shared by the OpenSSL Foundation last week, alerting the industry of the vulnerability and upcoming patch.

At Progress, security is a top priority. Upon notification, we conducted a thorough review of the Progress product portfolio, and our internal diligence indicates that our products are not using the impacted version of OpenSSL as shipped and/or deployed. Including following products:

• MOVEit
• MOVEit Cloud
• WS_FTP

We do, however, recommend that customers conduct their own due diligence with respect to any third-party components that may be utilized in their environments and take the appropriate actions recommended by those third parties.

We will continue to closely monitor the OpenSSL vulnerability and provide updates on the Progress Security Center as necessary. If you have additional questions regarding this message, you may contact [email protected] and we will quickly address those questions or concerns.

For more information regarding our security practices and privacy posture, please visit our Security Center and Privacy Center.