Re: OpenSSL 3.3.6 version showing critical vulnerability (CVE-2025-15467)
Raghu Chidambaram <[email protected]> Fri, 20 Mar 2026 09:16:33 -0700 (PDT)
| Newsgroups | gmane.comp.encryption.openssl.user |
|---|---|
| Message-ID | <[email protected]> |
------=_Part_35082_4571906.1774023393134 Content-Type: multipart/alternative; boundary="----=_Part_35083_623880573.1774023393134" ------=_Part_35083_623880573.1774023393134 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks Wojcik for detailed information on the BD. That helps :) On Friday, 20 March 2026 at 21:30:44 UTC+5:30 Michael Wojcik wrote: > From: [email protected] <[email protected]> On Behalf Of Raghu=20 > Chidambaram > Sent: Friday, 20 March, 2026 08:34 > > > just for your information why it is showing in 3.3.x and not in the=20 > veriosn 3.5.x > > as we use both version of OpenSSL > > Software Composition Analysis is a hard problem. Black Duck uses multiple= =20 > scanners to attempt to identify components and their versions, including= =20 > package-manager configuration parsers, source scanners, binary scanners,= =20 > and snippet scanners. It's well-known that BD often gets things wrong;=20 > that's why it has a UI and API for reconciling what the scanners think=20 > they've identified with what the development team actually knows (or find= s=20 > out after researching, since modern developers tend to include dependenci= es=20 > with wild abandon) is present. > > This is not an OpenSSL problem. It's not even really a Black Duck problem= ,=20 > in many cases (though there are certainly bugs and other issues with BD;= =20 > I've lost track of how many cases I've raised with them over the past=20 > year). It's a problem for organizations using Black Duck. SCA tooling is= =20 > still in its infancy and for typical native-code applications, SCA will= =20 > always require a lot of manual intervention. > > On the whole, BD is actually fairly capable, if irritating at times. But= =20 > it's capable in much the way a complex machine tool is: it requires skill= ed=20 > operators. It is very much not turn-on-and-walk-away. > > -- > Michael Wojcik > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D > Rocket Software, Inc. and subsidiaries =E2=96=A0 77 Fourth Avenue, Waltha= m MA=20 > 02451 =E2=96=A0 Main Office Toll Free Number: +1 855.577.4323 <(855)%2057= 7-4323> > Contact Customer Support:=20 > https://my.rocketsoftware.com/RocketCommunity/RCEmailSupport > Unsubscribe from Marketing Messages/Manage Your Subscription Preferences = -=20 > http://www.rocketsoftware.com/manage-your-email-preferences > Privacy Policy -=20 > http://www.rocketsoftware.com/company/legal/privacy-policy > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D > > This communication and any attachments may contain confidential=20 > information of Rocket Software, Inc. All unauthorized use, disclosure or= =20 > distribution is prohibited. If you are not the intended recipient, please= =20 > notify Rocket Software immediately and destroy all copies of this=20 > communication. Thank you. > --=20 You received this message because you are subscribed to the Google Groups "= openssl-users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org To view this discussion visit https://groups.google.com/a/openssl.org/d/msg= id/openssl-users/f10ad1cf-9b0f-4796-a919-1a798aef13a0n%40openssl.org. ------=_Part_35083_623880573.1774023393134 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks Wojcik for detailed information on the BD.<div>That helps :)<br /><b= r /></div><div class=3D"gmail_quote"><div dir=3D"auto" class=3D"gmail_attr"= >On Friday, 20 March 2026 at 21:30:44 UTC+5:30 Michael Wojcik wrote:<br/></= div><blockquote class=3D"gmail_quote" style=3D"margin: 0 0 0 0.8ex; border-= left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">From: <a href data-= email-masked rel=3D"nofollow">[email protected]</a> <<a href data-em= ail-masked rel=3D"nofollow">[email protected]</a>> On Behalf Of Ragh= u Chidambaram <br>Sent: Friday, 20 March, 2026 08:34 <br> <br>> just for your information why it is showing in 3.3.x and not in th= e veriosn 3.5.x <br>> as we use both version of OpenSSL <br> <br>Software Composition Analysis is a hard problem. Black Duck uses multip= le scanners to attempt to identify components and their versions, including= package-manager configuration parsers, source scanners, binary scanners, a= nd snippet scanners. It's well-known that BD often gets things wrong; t= hat's why it has a UI and API for reconciling what the scanners think t= hey've identified with what the development team actually knows (or fin= ds out after researching, since modern developers tend to include dependenc= ies with wild abandon) is present. <br> <br>This is not an OpenSSL problem. It's not even really a Black Duck p= roblem, in many cases (though there are certainly bugs and other issues wit= h BD; I've lost track of how many cases I've raised with them over = the past year). It's a problem for organizations using Black Duck. SCA = tooling is still in its infancy and for typical native-code applications, S= CA will always require a lot of manual intervention. <br> <br>On the whole, BD is actually fairly capable, if irritating at times. Bu= t it's capable in much the way a complex machine tool is: it requires s= killed operators. It is very much not turn-on-and-walk-away. <br> <br>-- <br>Michael Wojcik <br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D <br>Rocket Software, Inc. and subsidiaries =E2=96=A0 77 Fourth Avenue, Walt= ham MA 02451 =E2=96=A0 Main Office Toll Free Number: <a href=3D"tel:(855)%2= 0577-4323" value=3D"+18555774323" target=3D"_blank" rel=3D"nofollow">+1 855= .577.4323</a> <br>Contact Customer Support: <a href=3D"https://my.rocketsoftware.com/Rock= etCommunity/RCEmailSupport" target=3D"_blank" rel=3D"nofollow" data-safered= irecturl=3D"https://www.google.com/url?hl=3Den-GB&q=3Dhttps://my.rocket= software.com/RocketCommunity/RCEmailSupport&source=3Dgmail&ust=3D17= 74109452991000&usg=3DAOvVaw05idqk6I2w38RBvO5Mw3nP">https://my.rocketsof= tware.com/RocketCommunity/RCEmailSupport</a> <br>Unsubscribe from Marketing Messages/Manage Your Subscription Preference= s - <a href=3D"http://www.rocketsoftware.com/manage-your-email-preferences"= target=3D"_blank" rel=3D"nofollow" data-saferedirecturl=3D"https://www.goo= gle.com/url?hl=3Den-GB&q=3Dhttp://www.rocketsoftware.com/manage-your-em= ail-preferences&source=3Dgmail&ust=3D1774109452991000&usg=3DAOv= Vaw2Rwu5WwTPhJl_cwMNXUg6k">http://www.rocketsoftware.com/manage-your-email-= preferences</a> <br>Privacy Policy - <a href=3D"http://www.rocketsoftware.com/company/legal= /privacy-policy" target=3D"_blank" rel=3D"nofollow" data-saferedirecturl=3D= "https://www.google.com/url?hl=3Den-GB&q=3Dhttp://www.rocketsoftware.co= m/company/legal/privacy-policy&source=3Dgmail&ust=3D177410945299100= 0&usg=3DAOvVaw3oHbsVFWwKi5G-PKL6IJfl">http://www.rocketsoftware.com/com= pany/legal/privacy-policy</a> <br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D <br> <br>This communication and any attachments may contain confidential informa= tion of Rocket Software, Inc. All unauthorized use, disclosure or distribut= ion is prohibited. If you are not the intended recipient, please notify Roc= ket Software immediately and destroy all copies of this communication. Than= k you. <br></blockquote></div> <p></p> -- <br /> You received this message because you are subscribed to the Google Groups &= quot;openssl-users" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:openssl-users+unsubscribe-MCmKBN63+BlAfugRpC6u6w@public.gmane.org">openssl-us= [email protected]</a>.<br /> To view this discussion visit <a href=3D"https://groups.google.com/a/openss= l.org/d/msgid/openssl-users/f10ad1cf-9b0f-4796-a919-1a798aef13a0n%40openssl= .org?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/a/op= enssl.org/d/msgid/openssl-users/f10ad1cf-9b0f-4796-a919-1a798aef13a0n%40ope= nssl.org</a>.<br /> ------=_Part_35083_623880573.1774023393134-- ------=_Part_35082_4571906.1774023393134--