Upgrade openssl 3.3.7 → 3.5.6 LTS (3.3 stream EOL 2026-04)

[acortelyou]

Upgrade openssl 3.3.7 → 3.5.6 LTS (3.3 stream EOL 2026-04)

Is your feature request related to a problem? Please describe.

openssl (in SPECS/openssl/openssl.spec) is at 3.3.7 on the 3.3 release stream.

• 🔴 3.3 reached EOL 2026-04-09.
• Newer upstream releases: 4
• Latest upstream release: 4.0.0 (stream 4.0)
• Reference: https://endoflife.date/openssl (checked 2026-04-24)

Describe the solution you'd like

Upgrade openssl to 3.5.6 (3.5 LTS).

Describe alternatives you've considered

• Stay on 3.3, assume security maintenance (support ended 2026-04-09).
• Retire the openssl package.

Additional context

Newer upstream releases:

Stream	LTS?	Latest release	Status	Active support ends	EOL
3.4		3.4.5	🟢 supported	—	2026-10-22
3.5	⭐ LTS	3.5.6	🟢 supported	—	2030-04-08
3.6		3.6.2	🟢 supported	—	2026-11-01
4.0		4.0.0	🟢 supported	—	2027-05-14

Related work in this repo

• Issue Multiple medium vulnerabilities on core:3.0 image by grype - openssl, curl, expat #16783 (open, 2026-04-22) reports five medium openssl CVEs (CVE-2026-28388/89/90, CVE-2026-31789/90) detected by grype against mcr.microsoft.com/azurelinux/base/core:3.0 — concrete external CVE pressure on the EOL 3.3 stream.
• Issue Security bug found in Azure linux 3.0 image. #16884 (open, 2026-04-24) is a follow-up CoMET vulnerability scan against core:3.0 flagging additional security findings on the same base image.
• PR [AUTO-CHERRYPICK] Patch openssl for multiple Null Deref - branch main #16824 (open, AUTO-CHERRYPICK of Patch openssl for multiple Null Deref #16761) and PR [AUTOPATCHER-CORE] Upgrade openssl to 3.3.6 security updates #15590 (open, autopatcher to 3.3.6) keep patching within the now-EOL 3.3 stream. Each new upstream CVE will require the same downstream backport effort until we move to a supported stream.