OpenSSL files, installed with Toad for Oracle, are being flagged as having vulnerabilities (4226305)

OpenSSL files, installed with Toad for Oracle, are being flagged as having vulnerabilities

Using an internal tool that takes a snapshot of a system before and after Toad for Oracle is installed, to monitor what was added and/or modified by the installation. Two files flagged below are OpenSSL files identified having multiple vulnerabilities per the National Vulnerability Database.

C:\program files (x86)\quest software\quest installer\libeay32.dll    1.0.0f
OpenSSL Shared Library

C:\program files (x86)\quest software\quest installer\ssleay32.dll    1.0.0f
OpenSSL Shared Library

How are the OpenSSL libraries above being used in Toad and if it can be updated to the latest version without breaking the application?

The libraries in question are used for an HTTPS connection during installation to submit user registration information back to the Quest User Registration Server. This is the only time these libraries are used and will only get executed if User Registration is submitted at the end of the Installation process.

WORKAROUND 1:
Skip User Registration at the end of the Installation process.

WORKAROUND 2:
Use the Quest Software Portal, instead of the Installer for User Registration.

STATUS:
Enhancement request number DSI-200 has been submitted to Development for consideration in a future release of Toad for Oracle to upgrade the OpenSSL libraries.

DSI-200