OpenSSL Vulnerability Remediation on Azure VMs.

Defender for Cloud surfaces OpenSSL issues as part of its vulnerability assessment and “Remediate vulnerabilities” secure score control. The context provided does not include engine‑level details of how specific OpenSSL findings are detected or how to retrieve file paths for a particular CVE, but it does cover how such findings appear, how they affect secure score, how to remediate them, and how to exempt/suppress them when appropriate.

Based on the available information, the following actions are supported:

1. Understand how the vulnerability is represented in Defender for Cloud

• Vulnerabilities on Azure VMs are discovered by the Defender for Servers plan using Microsoft Defender Vulnerability Management and are surfaced as recommendations under the Remediate vulnerabilities control.
• These recommendations include:
  • The CVE(s) and CVSS score.
  • Remediation steps.
  • A list of affected machines.
• In secure score, all such items are grouped under the Remediate vulnerabilities control, which can contribute up to 6 points to the overall score when all vulnerability recommendations are remediated for all resources.

2. Locate and review the specific OpenSSL finding for a VM

Use the built‑in workflow for viewing vulnerability findings per VM and per recommendation:

1. In the Azure portal, go to Microsoft Defender for Cloud → Recommendations.
2. Locate and select the recommendation that corresponds to the OpenSSL vulnerability (it will be under the broader “Machines should have vulnerability findings resolved” or similar vulnerability‑related recommendation).
3. In the recommendation, open the Affected resources section and select one of the VMs where the OpenSSL vulnerability is reported.
4. Defender for Cloud will show the list of vulnerability findings for that VM, ordered by severity. Select the specific OpenSSL vulnerability entry.
5. In the vulnerability details pane, review:
   • The CVE identifiers.
   • The remediation steps.
   • Any additional reference pages.

The context confirms that this details pane is the authoritative place to see how Defender for Cloud is describing the vulnerability and how it expects it to be remediated, even though it does not explicitly list a file path field.

3. Verify and remediate on the VM where possible

• Use the information from the vulnerability details pane (CVE, product/version, OS family) to:
  • Query the package manager on the VM (for example, rpm, dpkg, apt, yum, or the Windows package inventory) for the OpenSSL version that matches the CVE.
  • Confirm whether the package is installed and whether it is at a vulnerable version.
• If the vulnerable package is found, follow the remediation steps in the details pane (for example, update the package to a fixed version) and then allow the next vulnerability scan cycle to re‑assess the VM.

4. If the component truly is not present or not in use

If, after checking the VM using OS‑level tools, the OpenSSL version indicated by the CVE cannot be found and is confirmed not to be installed or used, the supported approach is to manage the exception rather than leave the recommendation unresolved:

• Defender for Cloud guidance is to use exemptions to manage exceptions to vulnerability findings and recommendations.
• Disable rules for vulnerability findings are being deprecated; exemptions are the long‑term mechanism for suppressing or excluding specific findings from secure score and compliance calculations.

In this scenario, the recommended path is:

1. Validate locally on the VM that the vulnerable OpenSSL package/version is not installed or used.
2. Document the evidence (for internal audit) that the component is absent or not in use.
3. Create an exemption for the specific recommendation or resource, with a clear justification (for example, “Package not present; verified on host”).
4. Once exempted, the finding will no longer affect secure score for that resource in the context of that recommendation.
5. Impact on Secure Score and prioritization

• The Remediate vulnerabilities control contributes up to 6 points to secure score when all vulnerability recommendations are remediated across all resources.
• Secure score improves only when all recommendations in a control are addressed (remediated or appropriately exempted) for all resources.
• For high‑severity findings such as OpenSSL vulnerabilities, either remediation or a justified exemption is required to remove their impact on secure score.

If additional technical detail is needed about the exact detection logic (for example, specific scanner signatures or file‑system paths used internally by Defender Vulnerability Management), that information is not present in the provided context and would require opening a support case with Microsoft so that product engineering can review the specific finding on the affected VM(s).

References:

• Remediate recommendations in Microsoft Defender for Cloud
• Disable vulnerability findings
• Remediate machine vulnerabilities
• Secure score in Defender for Cloud (azure-portal)
• Security recommendations