RE: OpenSSL 3.3.6 version showing critical vulnerability (CVE-2025-15467)
"'Michael Wojcik' via openssl-users" <[email protected]> Fri, 20 Mar 2026 16:00:07 +0000
| Newsgroups | gmane.comp.encryption.openssl.user |
|---|---|
| Message-ID | <CH3PPFBCC09965CA0D9CF68B4E3C26C2D73C04CA@CH3PPFBCC09965C.namprd07.prod.outlook.com> |
From: [email protected] <[email protected]> On Behalf Of Ra= ghu Chidambaram Sent: Friday, 20 March, 2026 08:34 > just for your information why it is showing in 3.3.x and not in the verio= sn 3.5.x > as we use both version of OpenSSL Software Composition Analysis is a hard problem. Black Duck uses multiple s= canners to attempt to identify components and their versions, including pac= kage-manager configuration parsers, source scanners, binary scanners, and s= nippet scanners. It's well-known that BD often gets things wrong; that's wh= y it has a UI and API for reconciling what the scanners think they've ident= ified with what the development team actually knows (or finds out after res= earching, since modern developers tend to include dependencies with wild ab= andon) is present. This is not an OpenSSL problem. It's not even really a Black Duck problem, = in many cases (though there are certainly bugs and other issues with BD; I'= ve lost track of how many cases I've raised with them over the past year). = It's a problem for organizations using Black Duck. SCA tooling is still in = its infancy and for typical native-code applications, SCA will always requi= re a lot of manual intervention. On the whole, BD is actually fairly capable, if irritating at times. But it= 's capable in much the way a complex machine tool is: it requires skilled o= perators. It is very much not turn-on-and-walk-away. -- Michael Wojcik =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D Rocket Software, Inc. and subsidiaries =E2=96=A0 77 Fourth Avenue, Waltham = MA 02451 =E2=96=A0 Main Office Toll Free Number: +1 855.577.4323 Contact Customer Support: https://my.rocketsoftware.com/RocketCommunity/RCE= mailSupport Unsubscribe from Marketing Messages/Manage Your Subscription Preferences - = http://www.rocketsoftware.com/manage-your-email-preferences Privacy Policy - http://www.rocketsoftware.com/company/legal/privacy-policy =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D This communication and any attachments may contain confidential information= of Rocket Software, Inc. All unauthorized use, disclosure or distribution = is prohibited. If you are not the intended recipient, please notify Rocket = Software immediately and destroy all copies of this communication. Thank yo= u. --=20 You received this message because you are subscribed to the Google Groups "= openssl-users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org To view this discussion visit https://groups.google.com/a/openssl.org/d/msg= id/openssl-users/CH3PPFBCC09965CA0D9CF68B4E3C26C2D73C04CA%40CH3PPFBCC09965C= .namprd07.prod.outlook.com.