RE: OpenSSL 3.3.3 Security Vulnerability
"'Michael Wojcik' via openssl-users" <[email protected]> Wed, 1 Oct 2025 13:06:19 +0000
| Newsgroups | gmane.comp.encryption.openssl.user,gmane.comp.encryption.openssl.devel |
|---|---|
| Message-ID | <SA1PR07MB9764AF54B16AE66BD4A939B1C0E6A@SA1PR07MB9764.namprd07.prod.outlook.com> |
> From: 'Prasad, PCRaghavendra' via openssl-users <[email protected]= g> > Sent: Tuesday, 30 September, 2025 20:59 > But in OpenSSL 3.3.4, our blackduck tool is showing two versions one is 3= .3.3 and another is 3.3.4 > libssl - 3.3.3 > libcrypto - 3.3.4 BlackDuck's version detection for components which are not managed by a pac= kage manager is heuristic and, in my experience, quite often wrong. This wi= ll be particularly true for newer releases. You can verify for yourself tha= t your libssl is 3.3.4 (by examining your build and delivery processes) and= override the library version detected by BD. Or raise this as an issue wit= h BlackDuck. I haven't looked at the 3.3.4 sources, but this is probably not an OpenSSL = issue. -- Michael Wojcik =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D Rocket Software, Inc. and subsidiaries =E2=96=A0 77 Fourth Avenue, Waltham = MA 02451 =E2=96=A0 Main Office Toll Free Number: +1 855.577.4323 Contact Customer Support: https://my.rocketsoftware.com/RocketCommunity/RCE= mailSupport Unsubscribe from Marketing Messages/Manage Your Subscription Preferences - = http://www.rocketsoftware.com/manage-your-email-preferences Privacy Policy - http://www.rocketsoftware.com/company/legal/privacy-policy =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D This communication and any attachments may contain confidential information= of Rocket Software, Inc. All unauthorized use, disclosure or distribution = is prohibited. If you are not the intended recipient, please notify Rocket = Software immediately and destroy all copies of this communication. Thank yo= u. --=20 You received this message because you are subscribed to the Google Groups "= openssl-users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org To view this discussion visit https://groups.google.com/a/openssl.org/d/msg= id/openssl-users/SA1PR07MB9764AF54B16AE66BD4A939B1C0E6A%40SA1PR07MB9764.nam= prd07.prod.outlook.com.