Was NORBr affected by the November 2022 OpenSSL vulnerabilities?

No. NORBr's platform did not use the affected OpenSSL 3.x versions in 2022. Assessing exposure across systems and suppliers during a pre-announcement window remains the step every payment operator should run whenever a critical library flaw is announced, whether or not it turns out to be affected.

What happened in November 2022

The OpenSSL project pre-announced a critical vulnerability in the 3.x branch, later downgraded to high severity and published as two buffer overflow issues. The pre-announcement created a week of assessment across the industry: which systems ran OpenSSL 3.x, which suppliers did, and what the patch path was.

NORBr's position

• The platform did not run the affected OpenSSL 3.x versions at the time.
• The assessment still ran, across internal systems and suppliers, to confirm exposure.
• The outcome was documented for customers and auditors.

The practice that remains

Whether or not a given announcement turns out to affect a platform, the exercise is the same: an inventory of components and versions, a list of suppliers with their own exposure, a severity ranking, and a patch plan with owners. Payment operators should be able to run it within hours of a pre-announcement, because the next one may land on a library they do use. The November 2022 case is a useful rehearsal precisely because its outcome was benign for many.