Re: OpenSSL 3.3.6 version showing critical vulnerability (CVE-2025-15467)
Raghu Chidambaram <[email protected]> Fri, 20 Mar 2026 08:30:29 -0700 (PDT)
| Newsgroups | gmane.comp.encryption.openssl.user |
|---|---|
| Message-ID | <[email protected]> |
------=_Part_40018_719663534.1774020629773 Content-Type: multipart/alternative; boundary="----=_Part_40019_1539670543.1774020629773" ------=_Part_40019_1539670543.1774020629773 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable You need to report a bug by the vendor of the security scanner tool. --- sure will check once with the BD tool as well=20 thanks On Friday, 20 March 2026 at 18:23:39 UTC+5:30 Tomas Mraz wrote: > As mentioned in > https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467 > and > https://openssl-library.org/news/secadv/20260127.txt > > The issue is fixed in version 3.3.6. > > You need to report a bug by the vendor of the security scanner tool. > > Tomas Mraz, CTO, OpenSSL Foundation > > > On Fri, 2026-03-20 at 05:27 -0700, Raghu Chidambaram wrote: > > Thanks a lot for the information Tomas, then i m not very sure why > > our tool was showing two versions from 3.3.x versions onwards > > previously when we were in 3.1.x there were no issues. > >=20 > > it will show as shown below so then we got confused and searching the > > libssl.so with strings command. Then we found this version as 3.3.0 > >=20 > > so if you say that libssl doesn't have any affect then we will update > > manually in the tool . > >=20 > > The fix for CVE-2026-15467 is solely applying to > > libcrypto.so.3=20 > > so for the above issue we need to migrate to 3.3.7 or something? or > > it is already fixed in 3.3.6? > >=20 > > Thanks > >=20 > > On Thursday, 19 March 2026 at 13:54:51 UTC+5:30 Tomas Mraz wrote: > > > Hello Raghu, > > >=20 > > > There are multiple problems with your tool. > > >=20 > > > 1. It is misidentifying the version of libssl. Please note that the > > > presence of OPENSSL_3.3.0 in the version table of libssl.so.3 does > > > NOT > > > indicate that libssl is from the 3.3.0 release. > > >=20 > > > 2. (This is less of a problem of the tool as the tool might have > > > hard > > > time to know.) The fix for CVE-2026-15467 is solely applying to > > > libcrypto.so.3, there is no change in libssl.so.3 in regards to > > > this > > > issue. > > >=20 > > > I do not think this has ever changed. libssl AFAIK never contained > > > a > > > full OpenSSL version string. If you want, you can suggest an > > > enhancement in our public GitHub repository that we should include > > > a > > > full version string not just in libcrypto but also in libssl. > > >=20 > > > Kind regards, > > >=20 > > > Tomas Mraz, CTO, OpenSSL Foundation > > >=20 > > >=20 > > > On Wed, 2026-03-18 at 11:23 -0700, Raghu Chidambaram wrote: > > > > Hi Team, > > > >=20 > > > > our application we are using OpenSSL 3.3.6 version, recently we > > > > upgraded from 3.3.5 to 3.3.6. > > > >=20 > > > > our blackduck tool is reporting one critical issue in this > > > > version > > > > for libssl library. > > > >=20 > > > > CVE - CVE-2025-15467 > > > >=20 > > > > Till now when ever we take the OpenSSL version say x, both libssl > > > > and > > > > libcryto were showing same versions. but from OpenSSL 3.3.x > > > > onwards i > > > > m not sure why libssl shows different version and libcrypto shows > > > > different version. Why this discrepancy in the same OpenSSL code. > > > > Now > > > > because of this blackduck tool is showing critical issue in > > > > libssl. > > > >=20 > > > > so can you please provide some inputs on this on how to handle > > > > this > > > > case=20 > > > >=20 > > > > onefs-49-1# strings libcrypto.so.3 | grep "3.3.6" > > > > OpenSSL 3.3.6 27 Jan 2026 > > > > 3.3.6 > > > > onefs-49-1# strings libssl.so.3 | grep "3.3.0" > > > > OPENSSL_3.3.0 > > > > onefs-49-1# openssl version > > > > OpenSSL 3.3.6 27 Jan 2026 (Library: OpenSSL 3.3.6 27 Jan 2026) > > > > CVE-2025-15467 critical > > > > Thanks, > > > > Raghavendra > > > > --=20 > > > > You received this message because you are subscribed to the > > > > Google > > > > Groups "openssl-users" group. > > > > To unsubscribe from this group and stop receiving emails from it, > > > > send an email to [email protected] > > > > To view this discussion visit > > > >=20 > https://groups.google.com/a/openssl.org/d/msgid/openssl-users/5c6a2e7c-db= f7-438f-b68a-979474e88ef6n%40openssl.org > > >=20 > > >=20 > > > > . > > >=20 > > --=20 > Tom=C3=A1=C5=A1 Mr=C3=A1z, Chief Technology Officer, OpenSSL Foundation > We need your support! Help us protect digital privacy=E2=80=A6 everywhere= . > https://openssl.foundation/donate/ways-to-give > --=20 You received this message because you are subscribed to the Google Groups "= openssl-users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org To view this discussion visit https://groups.google.com/a/openssl.org/d/msg= id/openssl-users/54d4d316-8c86-45b2-87d9-ea6df1e986c1n%40openssl.org. ------=_Part_40019_1539670543.1774020629773 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <br />You need to report a bug by the vendor of the security scanner tool.<= div>--- sure will check once with the BD tool as well=C2=A0</div><div><br /= ></div><div>thanks</div><div class=3D"gmail_quote"><div dir=3D"auto" class= =3D"gmail_attr">On Friday, 20 March 2026 at 18:23:39 UTC+5:30 Tomas Mraz wr= ote:<br/></div><blockquote class=3D"gmail_quote" style=3D"margin: 0 0 0 0.8= ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">As menti= oned in <br><a href=3D"https://openssl-library.org/news/vulnerabilities/#CVE-2025-1= 5467" target=3D"_blank" rel=3D"nofollow" data-saferedirecturl=3D"https://ww= w.google.com/url?hl=3Den-GB&q=3Dhttps://openssl-library.org/news/vulner= abilities/%23CVE-2025-15467&source=3Dgmail&ust=3D1774106952937000&a= mp;usg=3DAOvVaw28Zci4YppKO7jfNxkBx-78">https://openssl-library.org/news/vul= nerabilities/#CVE-2025-15467</a> <br>and <br><a href=3D"https://openssl-library.org/news/secadv/20260127.txt" target= =3D"_blank" rel=3D"nofollow" data-saferedirecturl=3D"https://www.google.com= /url?hl=3Den-GB&q=3Dhttps://openssl-library.org/news/secadv/20260127.tx= t&source=3Dgmail&ust=3D1774106952937000&usg=3DAOvVaw0Xbp-kWCyFM= Ca1ySs0v2Of">https://openssl-library.org/news/secadv/20260127.txt</a> <br> <br>The issue is fixed in version 3.3.6. <br> <br>You need to report a bug by the vendor of the security scanner tool. <br> <br>Tomas Mraz, CTO, OpenSSL Foundation <br> <br> <br>On Fri, 2026-03-20 at 05:27 -0700, Raghu Chidambaram wrote: <br>> Thanks a lot for the information Tomas,=C2=A0 then i m not very su= re why <br>> our tool was showing two versions from 3.3.x versions onwards <br>> previously when we were in 3.1.x there were no issues. <br>>=20 <br>> it will show as shown below so then we got confused and searching = the <br>> libssl.so with strings command. Then we found this version as 3.3.= 0 <br>>=20 <br>> so if you say that libssl doesn't have any affect then we will= update <br>> manually in the tool . <br>>=20 <br>> The fix for CVE-2026-15467 is solely applying to <br>> libcrypto.so.3=C2=A0 <br>> so for the above issue we need to migrate to 3.3.7 or something? o= r <br>> it is already fixed in 3.3.6? <br>>=20 <br>> Thanks <br>>=20 <br>> On Thursday, 19 March 2026 at 13:54:51 UTC+5:30 Tomas Mraz wrote: <br>> > Hello Raghu, <br>> >=20 <br>> > There are multiple problems with your tool. <br>> >=20 <br>> > 1. It is misidentifying the version of libssl. Please note th= at the <br>> > presence of OPENSSL_3.3.0 in the version table of libssl.so.3= does <br>> > NOT <br>> > indicate that libssl is from the 3.3.0 release. <br>> >=20 <br>> > 2. (This is less of a problem of the tool as the tool might h= ave <br>> > hard <br>> > time to know.) The fix for CVE-2026-15467 is solely applying = to <br>> > libcrypto.so.3, there is no change in libssl.so.3 in regards = to <br>> > this <br>> > issue. <br>> >=20 <br>> > I do not think this has ever changed. libssl AFAIK never cont= ained <br>> > a <br>> > full OpenSSL version string. If you want, you can suggest an <br>> > enhancement in our public GitHub repository that we should in= clude <br>> > a <br>> > full version string not just in libcrypto but also in libssl. <br>> >=20 <br>> > Kind regards, <br>> >=20 <br>> > Tomas Mraz, CTO, OpenSSL Foundation <br>> >=20 <br>> >=20 <br>> > On Wed, 2026-03-18 at 11:23 -0700, Raghu Chidambaram wrote: <br>> > > Hi Team, <br>> > >=20 <br>> > > our application we are using OpenSSL 3.3.6 version, rece= ntly we <br>> > > upgraded from 3.3.5 to 3.3.6. <br>> > >=20 <br>> > > our blackduck tool is reporting one critical issue in th= is <br>> > > version <br>> > > for libssl library. <br>> > >=20 <br>> > > CVE -=C2=A0CVE-2025-15467 <br>> > >=20 <br>> > > Till now when ever we take the OpenSSL version say x, bo= th libssl <br>> > > and <br>> > > libcryto were showing same versions. but from OpenSSL 3.= 3.x <br>> > > onwards i <br>> > > m not sure why libssl shows different version and libcry= pto shows <br>> > > different version. Why this discrepancy in the same Open= SSL code. <br>> > > Now <br>> > > because of this blackduck tool is showing critical issue= in <br>> > > libssl. <br>> > >=20 <br>> > > so can you please provide some inputs on this on how to = handle <br>> > > this <br>> > > case=C2=A0 <br>> > >=20 <br>> > > onefs-49-1# strings libcrypto.so.3 | grep "3.3.6&qu= ot; <br>> > > OpenSSL 3.3.6 27 Jan 2026 <br>> > > 3.3.6 <br>> > > onefs-49-1# strings libssl.so.3 | grep "3.3.0" <br>> > > OPENSSL_3.3.0 <br>> > > =C2=A0onefs-49-1# openssl version <br>> > > OpenSSL 3.3.6 27 Jan 2026 (Library: OpenSSL 3.3.6 27 Jan= 2026) <br>> > > CVE-2025-15467 critical <br>> > > Thanks, <br>> > > Raghavendra <br>> > > --=20 <br>> > > You received this message because you are subscribed to = the <br>> > > Google <br>> > > Groups "openssl-users" group. <br>> > > To unsubscribe from this group and stop receiving emails= from it, <br>> > > send an email to <a href data-email-masked rel=3D"nofoll= ow">[email protected]</a>. <br>> > > To view this discussion visit <br>> > > <a href=3D"https://groups.google.com/a/openssl.org/d/msg= id/openssl-users/5c6a2e7c-dbf7-438f-b68a-979474e88ef6n%40openssl.org" targe= t=3D"_blank" rel=3D"nofollow" data-saferedirecturl=3D"https://www.google.co= m/url?hl=3Den-GB&q=3Dhttps://groups.google.com/a/openssl.org/d/msgid/op= enssl-users/5c6a2e7c-dbf7-438f-b68a-979474e88ef6n%2540openssl.org&sourc= e=3Dgmail&ust=3D1774106952937000&usg=3DAOvVaw1a6auRuLLxdW4az8_eUZgi= ">https://groups.google.com/a/openssl.org/d/msgid/openssl-users/5c6a2e7c-db= f7-438f-b68a-979474e88ef6n%40openssl.org</a> <br>> >=20 <br>> >=20 <br>> > > . <br>> >=20 <br> <br>--=20 <br>Tom=C3=A1=C5=A1 Mr=C3=A1z, Chief Technology Officer, OpenSSL Foundation <br>We need your support! Help us protect digital privacy=E2=80=A6 everywhe= re. <br><a href=3D"https://openssl.foundation/donate/ways-to-give" target=3D"_b= lank" rel=3D"nofollow" data-saferedirecturl=3D"https://www.google.com/url?h= l=3Den-GB&q=3Dhttps://openssl.foundation/donate/ways-to-give&source= =3Dgmail&ust=3D1774106952937000&usg=3DAOvVaw0gqJ5uN4tlYggUNuu0g4Ai"= >https://openssl.foundation/donate/ways-to-give</a> <br></blockquote></div> <p></p> -- <br /> You received this message because you are subscribed to the Google Groups &= quot;openssl-users" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:openssl-users+unsubscribe-MCmKBN63+BlAfugRpC6u6w@public.gmane.org">openssl-us= [email protected]</a>.<br /> To view this discussion visit <a href=3D"https://groups.google.com/a/openss= l.org/d/msgid/openssl-users/54d4d316-8c86-45b2-87d9-ea6df1e986c1n%40openssl= .org?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/a/op= enssl.org/d/msgid/openssl-users/54d4d316-8c86-45b2-87d9-ea6df1e986c1n%40ope= nssl.org</a>.<br /> ------=_Part_40019_1539670543.1774020629773-- ------=_Part_40018_719663534.1774020629773--