ARM OpenSSL version causing Tenable "OpenSSL 3.5.0 < 3.5.8 Vulnerability"
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
### Describe the issue
Similar to https://github.com/aws/aws-cli/issues/10415 and other ARM related OpenSSL updates.
For ARM instances with AWS CLI installed, Tenable is reporting https://www.tenable.com/plugins/nessus/335167
```
Path : /usr/local/aws-cli/v2/2.36.28/dist/libcrypto.so.3
Reported version : 3.5.7
Fixed version : 3.5.8
```
Also testing the latest version as of today.
```
% curl "https://awscli.amazonaws.com/awscli-exe-linux-aarch64-2.36.31.zip" -o "awscliv2.zip"
% unzip awscliv2.zip
% strings aws/dist/libcrypto.so.3 | grep "^OpenSSL 3"
OpenSSL 3.5.7 9 Jun 2026
```
### Additional Information/Context
_No response_
### CLI version used
2.36.31
### Environment details (OS name and version, etc.)
aarch/arm Linux
Contributor guide
Research direction
Start with the ARM Linux release archive and inspect the bundled dist/libcrypto.so.3 reported in the issue. Compare the OpenSSL version in the current 2.36.31 artifact with the required 3.5.8 fix, then verify that a rebuilt package no longer reports the vulnerable version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100