openssl 1.1.1/1.0.2 EOL impact on netty-tcnative-boringssl-static

[akshayjain328]

I am using netty-tcnative-boringssl-static <2.0.34.Final> with OpenSSL 1.0.2k-fips.
Now I am planning to upgrade OpenSSL to 3.x version as part of security upgrade. I have a few questions:

• What would be the impact of this upgrade?
• Would everything work as usual for the current version of netty-tcnative-boringssl-static?
• How to know netty-tcnative-boringssl-static is based(forked) out of which OpenSSL version?
• Do I need to upgrade netty-tcnative-boringssl-static to be compatible with OpenSSL 3.x ?

Any help/suggestions are appreciated.

[normanmaurer]

netty-tcnative-boringssl-static is NOT using openssl but BoringSSL.

[akshayjain328]

@normanmaurer I agree, but I see that BoringSSL is a fork of OpenSSL and I am not able to find that BoringSSL/netty-tcnative-boringssl-static is based out of which OpenSSL version that'y the confusion. Do you have any idea about this?

[akshayjain328]

Update: I was able to find out that netty-tcnative-boringssl-static <2.0.34.Final> is based out of OpenSSL 1.1.1g

[akshayjain328]

@normanmaurer any vulnerability affecting openssl 1.1.x would it impact boringSSL and hence netty-tcnative-boringssl-static?

[normanmaurer]

Again BoringSSL is different than openssl. While it was forked out of it at some point the code-bases are different these days and so often CVE's that affect openssl dont affect BoringSSL at all.

[akshayjain328]

Thank you @normanmaurer for the explanation.