Re: OpenSSL 3.3.6 version showing critical vulnerability (CVE-2025-15467)

Hello Raghu,

There are multiple problems with your tool.

1. It is misidentifying the version of libssl. Please note that the
presence of OPENSSL_3.3.0 in the version table of libssl.so.3 does NOT
indicate that libssl is from the 3.3.0 release.

2. (This is less of a problem of the tool as the tool might have hard
time to know.) The fix for CVE-2026-15467 is solely applying to
libcrypto.so.3, there is no change in libssl.so.3 in regards to this
issue.

I do not think this has ever changed. libssl AFAIK never contained a
full OpenSSL version string. If you want, you can suggest an
enhancement in our public GitHub repository that we should include a
full version string not just in libcrypto but also in libssl.

Kind regards,

Tomas Mraz, CTO, OpenSSL Foundation


On Wed, 2026-03-18 at 11:23 -0700, Raghu Chidambaram wrote:
> Hi Team,
>=20
> our application we are using OpenSSL 3.3.6 version, recently we
> upgraded from 3.3.5 to 3.3.6.
>=20
> our blackduck tool is reporting one critical issue in this version
> for libssl library.
>=20
> CVE -=C2=A0CVE-2025-15467
>=20
> Till now when ever we take the OpenSSL version say x, both libssl and
> libcryto were showing same versions. but from OpenSSL 3.3.x onwards i
> m not sure why libssl shows different version and libcrypto shows
> different version. Why this discrepancy in the same OpenSSL code. Now
> because of this blackduck tool is showing critical issue in libssl.
>=20
> so can you please provide some inputs on this on how to handle this
> case=C2=A0
>=20
> onefs-49-1# strings libcrypto.so.3 | grep "3.3.6"
> OpenSSL 3.3.6 27 Jan 2026
> 3.3.6
> onefs-49-1# strings libssl.so.3 | grep "3.3.0"
> OPENSSL_3.3.0
> =C2=A0onefs-49-1# openssl version
> OpenSSL 3.3.6 27 Jan 2026 (Library: OpenSSL 3.3.6 27 Jan 2026)
> CVE-2025-15467 critical
> Thanks,
> Raghavendra
> --=20
> You received this message because you are subscribed to the Google
> Groups "openssl-users" group.
> To unsubscribe from this group and stop receiving emails from it,
> send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
> To view this discussion visit
> https://groups.google.com/a/openssl.org/d/msgid/openssl-users/5c6a2e7c-db=
f7-438f-b68a-979474e88ef6n%40openssl.org
> .

--=20
Tom=C3=A1=C5=A1 Mr=C3=A1z, Chief Technology Officer, OpenSSL Foundation
We need your support! Help us protect digital privacy=E2=80=A6 everywhere.
https://openssl.foundation/donate/ways-to-give

--=20
You received this message because you are subscribed to the Google Groups "=
openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-users/783cca701f386621e4a8bc6fb9eba26270597cf3.camel%40openssl.f=
oundation.