aws / aws/aws-cli

ARM OpenSSL version causing Tenable "OpenSSL 3.5.0 < 3.5.8 Vulnerability"

Open
#10,602 1 comment 0 reactions 0 assignees View on GitHub
dependencies feature-request p2 source-distribution
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

### Describe the issue

Similar to https://github.com/aws/aws-cli/issues/10415 and other ARM related OpenSSL updates.

For ARM instances with AWS CLI installed, Tenable is reporting https://www.tenable.com/plugins/nessus/335167

```
Path : /usr/local/aws-cli/v2/2.36.28/dist/libcrypto.so.3
Reported version : 3.5.7
Fixed version : 3.5.8
```

Also testing the latest version as of today.

```
% curl "https://awscli.amazonaws.com/awscli-exe-linux-aarch64-2.36.31.zip" -o "awscliv2.zip"
% unzip awscliv2.zip
% strings aws/dist/libcrypto.so.3 | grep "^OpenSSL 3"
OpenSSL 3.5.7 9 Jun 2026
```

### Additional Information/Context

_No response_

### CLI version used

2.36.31

### Environment details (OS name and version, etc.)

aarch/arm Linux

Contributor guide

Open the contributing guide

Research direction

Start with the ARM Linux release archive and inspect the bundled dist/libcrypto.so.3 reported in the issue. Compare the OpenSSL version in the current 2.36.31 artifact with the required 3.5.8 fix, then verify that a rebuilt package no longer reports the vulnerable version.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.