Skip to content

ARM OpenSSL version causing Tenable "OpenSSL 3.5.0 < 3.5.7 Multiple Vulnerabilities" #10415

@alex-rowe

Description

@alex-rowe

Describe the issue

Similar to #8987 and other ARM related OpenSSL, but now OpenSSL v3 vs the previous v1 issues.

For ARM instances with AWS CLI installed, Tenable is reporting https://www.tenable.com/plugins/nessus/320136

Path             : /usr/local/aws-cli/v2/2.34.64/dist/libcrypto.so.3
  Reported version : 3.5.6
  Fixed version    : 3.5.7

Also testing the latest version

% curl "https://awscli.amazonaws.com/awscli-exe-linux-aarch64-2.35.5.zip" -o "awscliv2.zip"
% unzip awscliv2.zip 
% strings aws/dist/libcrypto.so.3 | grep "^OpenSSL 3"
OpenSSL 3.5.6 7 Apr 2026

Additional Information/Context

In https://github.com/aws/aws-cli/blob/v2/CHANGELOG.rst#23453 2.34.53 it was last updated

enhancement:OpenSSL: Update bundled OpenSSL version to 3.5.6 for Linux installers

CLI version used

2.35.5

Environment details (OS name and version, etc.)

Linux aarch64

Metadata

Metadata

Assignees

No one assigned

    Labels

    needs-triageThis issue or PR still needs to be triaged.source-distributioncli v2 source distritbution related issues

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions