RE: OpenSSL 3.3.6 version showing critical vulnerability (CVE-2025-15467)

"'Michael Wojcik' via openssl-users" <[email protected]> Fri, 20 Mar 2026 16:00:07 +0000
Newsgroups gmane.comp.encryption.openssl.user
Message-ID <CH3PPFBCC09965CA0D9CF68B4E3C26C2D73C04CA@CH3PPFBCC09965C.namprd07.prod.outlook.com>
From: [email protected] <[email protected]> On Behalf Of Ra=
ghu Chidambaram
Sent: Friday, 20 March, 2026 08:34

> just for your information why it is showing in 3.3.x and not in the verio=
sn 3.5.x
> as we use both version of OpenSSL

Software Composition Analysis is a hard problem. Black Duck uses multiple s=
canners to attempt to identify components and their versions, including pac=
kage-manager configuration parsers, source scanners, binary scanners, and s=
nippet scanners. It's well-known that BD often gets things wrong; that's wh=
y it has a UI and API for reconciling what the scanners think they've ident=
ified with what the development team actually knows (or finds out after res=
earching, since modern developers tend to include dependencies with wild ab=
andon) is present.

This is not an OpenSSL problem. It's not even really a Black Duck problem, =
in many cases (though there are certainly bugs and other issues with BD; I'=
ve lost track of how many cases I've raised with them over the past year). =
It's a problem for organizations using Black Duck. SCA tooling is still in =
its infancy and for typical native-code applications, SCA will always requi=
re a lot of manual intervention.

On the whole, BD is actually fairly capable, if irritating at times. But it=
's capable in much the way a complex machine tool is: it requires skilled o=
perators. It is very much not turn-on-and-walk-away.

--
Michael Wojcik
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D
Rocket Software, Inc. and subsidiaries =E2=96=A0 77 Fourth Avenue, Waltham =
MA 02451 =E2=96=A0 Main Office Toll Free Number: +1 855.577.4323
Contact Customer Support: https://my.rocketsoftware.com/RocketCommunity/RCE=
mailSupport
Unsubscribe from Marketing Messages/Manage Your Subscription Preferences - =
http://www.rocketsoftware.com/manage-your-email-preferences
Privacy Policy - http://www.rocketsoftware.com/company/legal/privacy-policy
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D

This communication and any attachments may contain confidential information=
 of Rocket Software, Inc. All unauthorized use, disclosure or distribution =
is prohibited. If you are not the intended recipient, please notify Rocket =
Software immediately and destroy all copies of this communication. Thank yo=
u.

--=20
You received this message because you are subscribed to the Google Groups "=
openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-users/CH3PPFBCC09965CA0D9CF68B4E3C26C2D73C04CA%40CH3PPFBCC09965C=
.namprd07.prod.outlook.com.