Re: OpenSSL 3.3.3 Security Vulnerability

On Tue, Oct 21, 2025 at 05:35:54AM +0000, 'Prasad, PCRaghavendra' via openssl-users wrote:

> We are currently on OpenSSL 3.3.3 version. On this version there is security vulnerability.
> To fix this we have upgraded the version to OpenSSL 3.3.4 which is mentioned that will resolve the issue.
> But in OpenSSL 3.3.4, our blackduck tool is showing two versions one is 3.3.3 and another is 3.3.4
> libssl - 3.3.3 libcrypto - 3.3.4

This report lacks sufficient detail to reach a meaningful conclusion as
to the cause of the reported symptoms.

You need to report what OpenSSL artefacts are installed on your system
and in what filesystem locations.  This includes headers, static and
shared libraries.

You also need to report a more detailed verbatim output from the tool
in question, and identify whether it is reporting any compile-time
data derived from your headers, runtime data from API calls to
libraries after linking with a specific static or shared library,
or by through sort fingerprinting scan by the tool (which could
be error prone, or might be confused if multiple OpenSSL versions
are installed).

-- 
    Viktor.  🇺🇦 Слава Україні!

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/aPce9WGfNnJkujqw%40chardros.imrryr.org.