Re: OpenSSL 3.3.6 version showing critical vulnerability (CVE-2025-15467)
Raghu Chidambaram <[email protected]> Fri, 20 Mar 2026 05:27:39 -0700 (PDT)
| Newsgroups | gmane.comp.encryption.openssl.user |
|---|---|
| Message-ID | <[email protected]> |
------=_Part_38770_707603199.1774009659428 Content-Type: multipart/alternative; boundary="----=_Part_38771_655307287.1774009659428" ------=_Part_38771_655307287.1774009659428 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks a lot for the information Tomas, then i m not very sure why our=20 tool was showing two versions from 3.3.x versions onwards previously when we were in 3.1.x there were no issues. it will show as shown below so then we got confused and searching the=20 libssl.so with strings command. Then we found this version as 3.3.0 so if you say that libssl doesn't have any affect then we will update=20 manually in the tool . *The fix for CVE-2026-15467 is solely applying to* *libcrypto.so.3 * so for the above issue we need to migrate to 3.3.7 or something? or it is= =20 already fixed in 3.3.6? Thanks On Thursday, 19 March 2026 at 13:54:51 UTC+5:30 Tomas Mraz wrote: > Hello Raghu, > > There are multiple problems with your tool. > > 1. It is misidentifying the version of libssl. Please note that the > presence of OPENSSL_3.3.0 in the version table of libssl.so.3 does NOT > indicate that libssl is from the 3.3.0 release. > > 2. (This is less of a problem of the tool as the tool might have hard > time to know.) The fix for CVE-2026-15467 is solely applying to > libcrypto.so.3, there is no change in libssl.so.3 in regards to this > issue. > > I do not think this has ever changed. libssl AFAIK never contained a > full OpenSSL version string. If you want, you can suggest an > enhancement in our public GitHub repository that we should include a > full version string not just in libcrypto but also in libssl. > > Kind regards, > > Tomas Mraz, CTO, OpenSSL Foundation > > > On Wed, 2026-03-18 at 11:23 -0700, Raghu Chidambaram wrote: > > Hi Team, > >=20 > > our application we are using OpenSSL 3.3.6 version, recently we > > upgraded from 3.3.5 to 3.3.6. > >=20 > > our blackduck tool is reporting one critical issue in this version > > for libssl library. > >=20 > > CVE - CVE-2025-15467 > >=20 > > Till now when ever we take the OpenSSL version say x, both libssl and > > libcryto were showing same versions. but from OpenSSL 3.3.x onwards i > > m not sure why libssl shows different version and libcrypto shows > > different version. Why this discrepancy in the same OpenSSL code. Now > > because of this blackduck tool is showing critical issue in libssl. > >=20 > > so can you please provide some inputs on this on how to handle this > > case=20 > >=20 > > onefs-49-1# strings libcrypto.so.3 | grep "3.3.6" > > OpenSSL 3.3.6 27 Jan 2026 > > 3.3.6 > > onefs-49-1# strings libssl.so.3 | grep "3.3.0" > > OPENSSL_3.3.0 > > onefs-49-1# openssl version > > OpenSSL 3.3.6 27 Jan 2026 (Library: OpenSSL 3.3.6 27 Jan 2026) > > CVE-2025-15467 critical > > Thanks, > > Raghavendra > > --=20 > > You received this message because you are subscribed to the Google > > Groups "openssl-users" group. > > To unsubscribe from this group and stop receiving emails from it, > > send an email to [email protected] > > To view this discussion visit > >=20 > https://groups.google.com/a/openssl.org/d/msgid/openssl-users/5c6a2e7c-db= f7-438f-b68a-979474e88ef6n%40openssl.org > > . > > --=20 > Tom=C3=A1=C5=A1 Mr=C3=A1z, Chief Technology Officer, OpenSSL Foundation > We need your support! Help us protect digital privacy=E2=80=A6 everywhere= . > https://openssl.foundation/donate/ways-to-give > --=20 You received this message because you are subscribed to the Google Groups "= openssl-users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org To view this discussion visit https://groups.google.com/a/openssl.org/d/msg= id/openssl-users/aef38c2f-9f89-4662-aeec-7de61909376cn%40openssl.org. ------=_Part_38771_655307287.1774009659428 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks a lot for the information Tomas,=C2=A0 then i m not very sure why ou= r tool was showing two versions from 3.3.x versions onwards<div>previously = when we were in 3.1.x there were no issues.</div><div><br /></div><div>it w= ill show as shown below so then we got confused and searching the libssl.so= with strings command. Then we found this version as 3.3.0</div><div><br />= </div><div>so if you say that libssl doesn't have any affect then we will u= pdate manually in the tool .</div><div><br /></div><div><i>The fix for CVE-= 2026-15467 is solely applying to</i><br /><i>libcrypto.so.3=C2=A0</i><br />= so for the above issue we need to migrate to 3.3.7 or something? or it is a= lready fixed in 3.3.6?</div><div><br /></div><div>Thanks<br /><br /></div><= div class=3D"gmail_quote"><div dir=3D"auto" class=3D"gmail_attr">On Thursda= y, 19 March 2026 at 13:54:51 UTC+5:30 Tomas Mraz wrote:<br/></div><blockquo= te class=3D"gmail_quote" style=3D"margin: 0 0 0 0.8ex; border-left: 1px sol= id rgb(204, 204, 204); padding-left: 1ex;">Hello Raghu, <br> <br>There are multiple problems with your tool. <br> <br>1. It is misidentifying the version of libssl. Please note that the <br>presence of OPENSSL_3.3.0 in the version table of libssl.so.3 does NOT <br>indicate that libssl is from the 3.3.0 release. <br> <br>2. (This is less of a problem of the tool as the tool might have hard <br>time to know.) The fix for CVE-2026-15467 is solely applying to <br>libcrypto.so.3, there is no change in libssl.so.3 in regards to this <br>issue. <br> <br>I do not think this has ever changed. libssl AFAIK never contained a <br>full OpenSSL version string. If you want, you can suggest an <br>enhancement in our public GitHub repository that we should include a <br>full version string not just in libcrypto but also in libssl. <br> <br>Kind regards, <br> <br>Tomas Mraz, CTO, OpenSSL Foundation <br> <br> <br>On Wed, 2026-03-18 at 11:23 -0700, Raghu Chidambaram wrote: <br>> Hi Team, <br>>=20 <br>> our application we are using OpenSSL 3.3.6 version, recently we <br>> upgraded from 3.3.5 to 3.3.6. <br>>=20 <br>> our blackduck tool is reporting one critical issue in this version <br>> for libssl library. <br>>=20 <br>> CVE -=C2=A0CVE-2025-15467 <br>>=20 <br>> Till now when ever we take the OpenSSL version say x, both libssl = and <br>> libcryto were showing same versions. but from OpenSSL 3.3.x onward= s i <br>> m not sure why libssl shows different version and libcrypto shows <br>> different version. Why this discrepancy in the same OpenSSL code. = Now <br>> because of this blackduck tool is showing critical issue in libssl= . <br>>=20 <br>> so can you please provide some inputs on this on how to handle thi= s <br>> case=C2=A0 <br>>=20 <br>> onefs-49-1# strings libcrypto.so.3 | grep "3.3.6" <br>> OpenSSL 3.3.6 27 Jan 2026 <br>> 3.3.6 <br>> onefs-49-1# strings libssl.so.3 | grep "3.3.0" <br>> OPENSSL_3.3.0 <br>> =C2=A0onefs-49-1# openssl version <br>> OpenSSL 3.3.6 27 Jan 2026 (Library: OpenSSL 3.3.6 27 Jan 2026) <br>> CVE-2025-15467 critical <br>> Thanks, <br>> Raghavendra <br>> --=20 <br>> You received this message because you are subscribed to the Google <br>> Groups "openssl-users" group. <br>> To unsubscribe from this group and stop receiving emails from it, <br>> send an email to <a href data-email-masked rel=3D"nofollow">openss= [email protected]</a>. <br>> To view this discussion visit <br>> <a href=3D"https://groups.google.com/a/openssl.org/d/msgid/openssl= -users/5c6a2e7c-dbf7-438f-b68a-979474e88ef6n%40openssl.org" target=3D"_blan= k" rel=3D"nofollow" data-saferedirecturl=3D"https://www.google.com/url?hl= =3Den-GB&q=3Dhttps://groups.google.com/a/openssl.org/d/msgid/openssl-us= ers/5c6a2e7c-dbf7-438f-b68a-979474e88ef6n%2540openssl.org&source=3Dgmai= l&ust=3D1774095704358000&usg=3DAOvVaw2BXIo6IN-7Vwvs-6_aeCC0">https:= //groups.google.com/a/openssl.org/d/msgid/openssl-users/5c6a2e7c-dbf7-438f-= b68a-979474e88ef6n%40openssl.org</a> <br>> . <br> <br>--=20 <br>Tom=C3=A1=C5=A1 Mr=C3=A1z, Chief Technology Officer, OpenSSL Foundation <br>We need your support! Help us protect digital privacy=E2=80=A6 everywhe= re. <br><a href=3D"https://openssl.foundation/donate/ways-to-give" target=3D"_b= lank" rel=3D"nofollow" data-saferedirecturl=3D"https://www.google.com/url?h= l=3Den-GB&q=3Dhttps://openssl.foundation/donate/ways-to-give&source= =3Dgmail&ust=3D1774095704358000&usg=3DAOvVaw0_YZlwKaUyHaTfMbxj2NZD"= >https://openssl.foundation/donate/ways-to-give</a> <br></blockquote></div> <p></p> -- <br /> You received this message because you are subscribed to the Google Groups &= quot;openssl-users" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:openssl-users+unsubscribe-MCmKBN63+BlAfugRpC6u6w@public.gmane.org">openssl-us= [email protected]</a>.<br /> To view this discussion visit <a href=3D"https://groups.google.com/a/openss= l.org/d/msgid/openssl-users/aef38c2f-9f89-4662-aeec-7de61909376cn%40openssl= .org?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/a/op= enssl.org/d/msgid/openssl-users/aef38c2f-9f89-4662-aeec-7de61909376cn%40ope= nssl.org</a>.<br /> ------=_Part_38771_655307287.1774009659428-- ------=_Part_38770_707603199.1774009659428--