AD2044: DoNotStaticallyLinkOpenSSLPE¶

Summary¶

Description¶

PE binaries should not statically link OpenSSL. Static linking makes it difficult to update OpenSSL when security vulnerabilities are discovered.

How It Works¶

The rule detects statically linked OpenSSL by:

1. Scanning for OpenSSL version strings
2. Checking for OpenSSL function symbols without imports
3. Detecting OpenSSL-specific code patterns

Why This Matters¶

OpenSSL has a history of critical security vulnerabilities. Static linking prevents easy patching.

OpenSSL Vulnerability History¶

Static vs Dynamic Linking¶

Patching Timeline¶

Vulnerability Disclosed
    ↓
Static Linking:            Dynamic Linking:
├── Wait for rebuild       ├── Update DLL
├── Retest                 ├── Restart apps
├── Redeploy               └── Done (hours)
└── Done (days/weeks)

Exceptions¶

Resolution¶

Use dynamic linking for OpenSSL:

# CMake - prefer shared libraries
find_package(OpenSSL REQUIRED)
target_link_libraries(myapp OpenSSL::SSL OpenSSL::Crypto)
# Ensure BUILD_SHARED_LIBS is set

vcpkg Configuration¶

{
  "dependencies": [
    { "name": "openssl", "features": ["shared"] }
  ]
}