OpenSSL 1.1.1u

Problem Description 

Various components, such as Python, use OpenSSL version 1.1.1u internally. As no newer versions are yet released/available for these components, the associated vulnerability CVE-2023-4807 cannot be removed. 

The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. 

If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences up to data corruption and control of the application process.