RE: OpenSSL 3.3.3 Security Vulnerability

From: 'Prasad, PCRaghavendra' via openssl-users <[email protected]>
Sent: Monday, 20 October, 2025 23:36
To: [email protected]; [email protected]

...

> But in OpenSSL 3.3.4, our blackduck tool is showing two versions one is 3.3.3 and another is 3.3.4

As I noted in my reply the first time you asked this, 2025-10-01, BlackDuck is often wrong about detected versions. You have to fix the BlackDuck scan results manually. This is a very well-known issue with BlackDuck.

This is NOT an OpenSSL issue. It conceivably could be a problem with your build process, but is almost certainly a BlackDuck issue. Fix it manually in the scan, or take it up with BlackDuck.

--
Michael Wojcik
================================
Rocket Software, Inc. and subsidiaries ■ 77 Fourth Avenue, Waltham MA 02451 ■ Main Office Toll Free Number: +1 855.577.4323
Contact Customer Support: https://my.rocketsoftware.com/RocketCommunity/RCEmailSupport
Unsubscribe from Marketing Messages/Manage Your Subscription Preferences - http://www.rocketsoftware.com/manage-your-email-preferences
Privacy Policy - http://www.rocketsoftware.com/company/legal/privacy-policy
================================

This communication and any attachments may contain confidential information of Rocket Software, Inc. All unauthorized use, disclosure or distribution is prohibited. If you are not the intended recipient, please notify Rocket Software immediately and destroy all copies of this communication. Thank you.

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/SA1PR07MB9764703AA462714E1A0B96B4C0F2A%40SA1PR07MB9764.namprd07.prod.outlook.com.