ODBC Simba Drivers CVE-2024-5535

Hi Mat91 

The vulnerability CVE-2024-5535 related to the Power BI ODBC Simba drivers involves a known issue in the OpenSSL version used. Here are steps and recommendations for addressing the issue:

Steps to Address the Vulnerability:
Verify OpenSSL Version:

The OpenSSL version mentioned (less than 3.0.15) is outdated. Confirm the OpenSSL version in your environment by checking the DLL file in the path you provided:
mathematica
Copy code
C:\Program Files\Microsoft Power BI Desktop\bin\ODBC Drivers\Simba * ODBC Driver\libssl-3-x64.dll
If it's older than 3.0.15, this matches the vulnerability criteria.
Check for Updates or Patches:

Check if Microsoft has released a patch for Power BI Desktop that updates the underlying ODBC Simba driver or OpenSSL library.
Visit the Microsoft Power BI Release Notes or the specific Security Updates page to see if there’s an announcement regarding this CVE.
Manual Workaround: If no patch is available yet, you can manually replace the OpenSSL libraries in the ODBC Simba driver folder with a more recent version. However, be cautious:

Ensure you back up the current files.
Obtain the updated OpenSSL files (e.g., libssl-3-x64.dll and libcrypto-3-x64.dll) from a trusted source such as the official OpenSSL project.
Replace the files in the directory and test your Power BI Desktop to confirm it functions correctly.
Application Behavior:

Verify whether your specific usage of Power BI requires the OpenSSL API function SSL_select_next_proto. If this function is not actively utilized in your workflows, the vulnerability might not pose an immediate risk.
If unsure, consult with Microsoft support or your IT security team for further clarification.
Reach Out to Simba or Microsoft Support:

If no fixes are available, report this to Simba and Microsoft support teams. They can provide guidance on whether a patch is in development or any mitigation steps.
Consider Network Controls: In the interim, restrict access to the affected application or enforce SSL/TLS protocols through external controls to minimize the attack surface.

If this post helps, then please consider Accepting it as the solution to help the other members find it more quickly.