Repository navigation
ARM OpenSSL version causing Tenable "OpenSSL 3.5.0 < 3.5.7 Multiple Vulnerabilities" #10415
Description
Describe the issue
Similar to #8987 and other ARM related OpenSSL, but now OpenSSL v3 vs the previous v1 issues.
For ARM instances with AWS CLI installed, Tenable is reporting https://www.tenable.com/plugins/nessus/320136
Path : /usr/local/aws-cli/v2/2.34.64/dist/libcrypto.so.3
Reported version : 3.5.6
Fixed version : 3.5.7
Also testing the latest version
% curl "https://awscli.amazonaws.com/awscli-exe-linux-aarch64-2.35.5.zip" -o "awscliv2.zip"
% unzip awscliv2.zip
% strings aws/dist/libcrypto.so.3 | grep "^OpenSSL 3"
OpenSSL 3.5.6 7 Apr 2026
Additional Information/Context
In https://github.com/aws/aws-cli/blob/v2/CHANGELOG.rst#23453 2.34.53 it was last updated
enhancement:OpenSSL: Update bundled OpenSSL version to 3.5.6 for Linux installers
CLI version used
2.35.5
Environment details (OS name and version, etc.)
Linux aarch64
Activity
adev-code commentedon Jun 26, 2026
Thanks for reaching out @alex-rowe. The AWS CLI doesn't call the PKCS#7, CMS, PKCS#12, CMP, QUIC, or AES-OCB/SIV code paths these CVEs require, so it isn't affected. We'll keep this open until the bundled OpenSSL is updated to 3.5.7 for the Linux installers so scanners stop flagging it, and update here when it ships.
ashovlin commentedon Jul 2, 2026
We upgraded OpenSSL to 3.5.7 in the Linux installers in 2.35.14 released today. Let us know if you're still seeing scanner results after upgrading.
github-actions commentedon Jul 2, 2026
This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.