# \#security
**URL:** https://meta.discourse.org/tag/security/505.md
[Latest](https://meta.discourse.org/latest.md) · [Categories](https://meta.discourse.org/categories.md) · [Tags](https://meta.discourse.org/tags.md)
---
## [Statement Regarding OpenSSL Vulnerabilities 2022-11-01](https://meta.discourse.org/t/statement-regarding-openssl-vulnerabilities-2022-11-01/244230)
**Author:** [@jomaxro](https://meta.discourse.org/u/jomaxro)\
**Replies:** 0\
**Last updated:** [November 3, 2022, 7:38pm UTC](https://meta.discourse.org/t/statement-regarding-openssl-vulnerabilities-2022-11-01/244230 "2022-11-03T19:38:57Z")
The distributed Discourse image (used by both self-hosters and on our SaaS platform) uses Debian OpenSSL 1.1.1n-0+deb11u3 and is not vulnerable to OpenSSL’s CVE-2022-3786 and CVE-2022-3602. More details on the vulnerabi…
---
## [Critical security fix for the discourse-patreon plugin](https://meta.discourse.org/t/critical-security-fix-for-the-discourse-patreon-plugin/242999)
**Author:** [@david](https://meta.discourse.org/u/david)\
**Replies:** 0\
**Last updated:** [October 27, 2022, 1:38am UTC](https://meta.discourse.org/t/critical-security-fix-for-the-discourse-patreon-plugin/242999 "2022-10-27T01:38:47Z")
We have just released a critical security fix for the discourse-patreon plugin. If you use this plugin, please make sure to update as soon as possible. If you are hosted by us at discourse.org, the fix has already been …
---
## [Discourse and the Log4j vulnerability](https://meta.discourse.org/t/discourse-and-the-log4j-vulnerability/212609)
**Author:** [@sam](https://meta.discourse.org/u/sam)\
**Replies:** 1\
**Last updated:** [March 18, 2022, 2:32am UTC](https://meta.discourse.org/t/discourse-and-the-log4j-vulnerability/212609 "2022-03-18T02:32:06Z")
On 9th December, CVE 2021-44228 was published for log4j, a commonly-used Java logging library. Subsequently, CVE-2021-45046 and CVE-2021-45105 have also been published. We’ve received a number of questions about these vu…