Re: OpenSSL 3.3.6 version showing critical vulnerability (CVE-2025-15467)

Raghu Chidambaram <[email protected]> Fri, 20 Mar 2026 09:16:33 -0700 (PDT)
Newsgroups gmane.comp.encryption.openssl.user
Message-ID <[email protected]>
------=_Part_35082_4571906.1774023393134
Content-Type: multipart/alternative; 
	boundary="----=_Part_35083_623880573.1774023393134"

------=_Part_35083_623880573.1774023393134
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Thanks Wojcik for detailed information on the BD.
That helps :)

On Friday, 20 March 2026 at 21:30:44 UTC+5:30 Michael Wojcik wrote:

> From: [email protected] <[email protected]> On Behalf Of Raghu=20
> Chidambaram
> Sent: Friday, 20 March, 2026 08:34
>
> > just for your information why it is showing in 3.3.x and not in the=20
> veriosn 3.5.x
> > as we use both version of OpenSSL
>
> Software Composition Analysis is a hard problem. Black Duck uses multiple=
=20
> scanners to attempt to identify components and their versions, including=
=20
> package-manager configuration parsers, source scanners, binary scanners,=
=20
> and snippet scanners. It's well-known that BD often gets things wrong;=20
> that's why it has a UI and API for reconciling what the scanners think=20
> they've identified with what the development team actually knows (or find=
s=20
> out after researching, since modern developers tend to include dependenci=
es=20
> with wild abandon) is present.
>
> This is not an OpenSSL problem. It's not even really a Black Duck problem=
,=20
> in many cases (though there are certainly bugs and other issues with BD;=
=20
> I've lost track of how many cases I've raised with them over the past=20
> year). It's a problem for organizations using Black Duck. SCA tooling is=
=20
> still in its infancy and for typical native-code applications, SCA will=
=20
> always require a lot of manual intervention.
>
> On the whole, BD is actually fairly capable, if irritating at times. But=
=20
> it's capable in much the way a complex machine tool is: it requires skill=
ed=20
> operators. It is very much not turn-on-and-walk-away.
>
> --
> Michael Wojcik
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D
> Rocket Software, Inc. and subsidiaries =E2=96=A0 77 Fourth Avenue, Waltha=
m MA=20
> 02451 =E2=96=A0 Main Office Toll Free Number: +1 855.577.4323 <(855)%2057=
7-4323>
> Contact Customer Support:=20
> https://my.rocketsoftware.com/RocketCommunity/RCEmailSupport
> Unsubscribe from Marketing Messages/Manage Your Subscription Preferences =
-=20
> http://www.rocketsoftware.com/manage-your-email-preferences
> Privacy Policy -=20
> http://www.rocketsoftware.com/company/legal/privacy-policy
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D
>
> This communication and any attachments may contain confidential=20
> information of Rocket Software, Inc. All unauthorized use, disclosure or=
=20
> distribution is prohibited. If you are not the intended recipient, please=
=20
> notify Rocket Software immediately and destroy all copies of this=20
> communication. Thank you.
>

--=20
You received this message because you are subscribed to the Google Groups "=
openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-users/f10ad1cf-9b0f-4796-a919-1a798aef13a0n%40openssl.org.

------=_Part_35083_623880573.1774023393134
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Thanks Wojcik for detailed information on the BD.<div>That helps :)<br /><b=
r /></div><div class=3D"gmail_quote"><div dir=3D"auto" class=3D"gmail_attr"=
>On Friday, 20 March 2026 at 21:30:44 UTC+5:30 Michael Wojcik wrote:<br/></=
div><blockquote class=3D"gmail_quote" style=3D"margin: 0 0 0 0.8ex; border-=
left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">From: <a href data-=
email-masked rel=3D"nofollow">[email protected]</a> &lt;<a href data-em=
ail-masked rel=3D"nofollow">[email protected]</a>&gt; On Behalf Of Ragh=
u Chidambaram
<br>Sent: Friday, 20 March, 2026 08:34
<br>
<br>&gt; just for your information why it is showing in 3.3.x and not in th=
e veriosn 3.5.x
<br>&gt; as we use both version of OpenSSL
<br>
<br>Software Composition Analysis is a hard problem. Black Duck uses multip=
le scanners to attempt to identify components and their versions, including=
 package-manager configuration parsers, source scanners, binary scanners, a=
nd snippet scanners. It&#39;s well-known that BD often gets things wrong; t=
hat&#39;s why it has a UI and API for reconciling what the scanners think t=
hey&#39;ve identified with what the development team actually knows (or fin=
ds out after researching, since modern developers tend to include dependenc=
ies with wild abandon) is present.
<br>
<br>This is not an OpenSSL problem. It&#39;s not even really a Black Duck p=
roblem, in many cases (though there are certainly bugs and other issues wit=
h BD; I&#39;ve lost track of how many cases I&#39;ve raised with them over =
the past year). It&#39;s a problem for organizations using Black Duck. SCA =
tooling is still in its infancy and for typical native-code applications, S=
CA will always require a lot of manual intervention.
<br>
<br>On the whole, BD is actually fairly capable, if irritating at times. Bu=
t it&#39;s capable in much the way a complex machine tool is: it requires s=
killed operators. It is very much not turn-on-and-walk-away.
<br>
<br>--
<br>Michael Wojcik
<br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
<br>Rocket Software, Inc. and subsidiaries =E2=96=A0 77 Fourth Avenue, Walt=
ham MA 02451 =E2=96=A0 Main Office Toll Free Number: <a href=3D"tel:(855)%2=
0577-4323" value=3D"+18555774323" target=3D"_blank" rel=3D"nofollow">+1 855=
.577.4323</a>
<br>Contact Customer Support: <a href=3D"https://my.rocketsoftware.com/Rock=
etCommunity/RCEmailSupport" target=3D"_blank" rel=3D"nofollow" data-safered=
irecturl=3D"https://www.google.com/url?hl=3Den-GB&amp;q=3Dhttps://my.rocket=
software.com/RocketCommunity/RCEmailSupport&amp;source=3Dgmail&amp;ust=3D17=
74109452991000&amp;usg=3DAOvVaw05idqk6I2w38RBvO5Mw3nP">https://my.rocketsof=
tware.com/RocketCommunity/RCEmailSupport</a>
<br>Unsubscribe from Marketing Messages/Manage Your Subscription Preference=
s - <a href=3D"http://www.rocketsoftware.com/manage-your-email-preferences"=
 target=3D"_blank" rel=3D"nofollow" data-saferedirecturl=3D"https://www.goo=
gle.com/url?hl=3Den-GB&amp;q=3Dhttp://www.rocketsoftware.com/manage-your-em=
ail-preferences&amp;source=3Dgmail&amp;ust=3D1774109452991000&amp;usg=3DAOv=
Vaw2Rwu5WwTPhJl_cwMNXUg6k">http://www.rocketsoftware.com/manage-your-email-=
preferences</a>
<br>Privacy Policy - <a href=3D"http://www.rocketsoftware.com/company/legal=
/privacy-policy" target=3D"_blank" rel=3D"nofollow" data-saferedirecturl=3D=
"https://www.google.com/url?hl=3Den-GB&amp;q=3Dhttp://www.rocketsoftware.co=
m/company/legal/privacy-policy&amp;source=3Dgmail&amp;ust=3D177410945299100=
0&amp;usg=3DAOvVaw3oHbsVFWwKi5G-PKL6IJfl">http://www.rocketsoftware.com/com=
pany/legal/privacy-policy</a>
<br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
<br>
<br>This communication and any attachments may contain confidential informa=
tion of Rocket Software, Inc. All unauthorized use, disclosure or distribut=
ion is prohibited. If you are not the intended recipient, please notify Roc=
ket Software immediately and destroy all copies of this communication. Than=
k you.
<br></blockquote></div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;openssl-users&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:openssl-users+unsubscribe-MCmKBN63+BlAfugRpC6u6w@public.gmane.org">openssl-us=
[email protected]</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/a/openss=
l.org/d/msgid/openssl-users/f10ad1cf-9b0f-4796-a919-1a798aef13a0n%40openssl=
.org?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/a/op=
enssl.org/d/msgid/openssl-users/f10ad1cf-9b0f-4796-a919-1a798aef13a0n%40ope=
nssl.org</a>.<br />

------=_Part_35083_623880573.1774023393134--

------=_Part_35082_4571906.1774023393134--