What version of OpenSSL is in Python 3.12?
Python v3.12.5 (CPython) utilizes OpenSSL 3.0.13 as its canonical cryptographic and TLS engine via the standard library _ssl and _hashlib C-extensions. On Linux, Python links dynamically against the host system's libssl.so.3 and libcrypto.so.3, while official macOS and Windows installer binaries statically bundle OpenSSL 3.0.
🔗 Dependency Relationship
| Package | Version | Relationship | Ingestion Scope | Package URL (PURL) |
|---|---|---|---|---|
| openssl Target | 3.0.13 | Direct Dependency | ↳ Dynamic host ABI boundary (Linux) / Statically bundled (macOS & Windows) | pkg:generic/openssl@3.0.13 |
| libssl.so.3 | 3.0.x | Direct Dependency | ↳ Dynamic host ABI boundary | pkg:generic/libssl.so.3@3.0.x |
| libcrypto.so.3 | 3.0.x | Transitive Dependency | ↳ Dynamic host ABI boundary | pkg:generic/libcrypto.so.3@3.0.x |
Python 3.12 (CPython) links OpenSSL through a hybrid distribution model. On Linux platforms (including official Debian/Ubuntu and manylinux container images), CPython compiles its standard library `_ssl` and `_hashlib` C-extensions to link dynamically against the host operating system's OpenSSL 3.0 shared objects (`libssl.so.3` and `libcrypto.so.3`). Conversely, official Windows and macOS installers bundle statically compiled OpenSSL 3.0 binaries. This divergence creates significant supply chain posture differences: Linux container workloads inherit host distribution patch releases immediately without rebuilding Python, whereas binary PyPI wheels bundling isolated OpenSSL copies require explicit rebuilding via `auditwheel` to remediate upstream CVEs. (source: Python Software Foundation) ↗ (source: Python PEP Index) ↗
SBOM Insights
⚡ Synthesized SBOM
Deterministic baseline metadata collected on-demand from the upstream Google deps.dev v3 package graph without repository checkout.
Supply Chain Governance
Python 3.12 is regulated by the following European Union and United States supply chain directives and security frameworks:
| Regulatory Body | Directive / Framework | Official Identifier | Statutory Scope & Classification | Official Directive |
|---|---|---|---|---|
| European Union / European Commission | EU Cyber Resilience Act (CRA) | Regulation (EU) 2024/2847 | Important Product with Digital Elements (Class I / General Purpose Operating & Runtime Environment) | Directive Text ↗ |
| ENISA / European Commission | NIS2 Directive | Directive (EU) 2022/2555 | Digital Infrastructure & Cloud Services (Annex I - Essential Entity) | Directive Text ↗ |
| NIST / CMVP | FIPS 140-2 / 140-3 Cryptographic Standards | FIPS PUB 140-3 | Security Requirements for Cryptographic Modules | Directive Text ↗ |
Authoritative Verified Facts & Advisories
Authoritative weakness definitions, CVE records, and predictive EPSS weaponization telemetry partitioned by target dependency and host container environment.
Target Package Advisories & Weaknesses: openssl
5 Verified RecordsABI mismatch and symbol conflicts between CPython host libssl.so.3 and binary wheels statically bundling disparate OpenSSL builds.
Memory race condition in ssl.SSLContext certificate store methods during concurrent multithreaded TLS handshakes.
Unbounded memory growth flaw in OpenSSL session ticket caching triggered during concurrent TLS handshake renegotiation.
Denial of service via excessive computational resource consumption during validation of overly long DSA keys in OpenSSL.
Use-after-free vulnerability in OpenSSL when freeing buffers after handling incoming TLS network traffic.
Host Application Advisories: Python v3.12.5
Race condition in CPython ssl module certificate store manipulation leading to memory corruption or crashes under multithreaded load.
TLS handshake bypass vulnerability in ssl socket handling where closing before handshake completion could leak unencrypted buffers.
Lock Down Your Python Supply Chain with Packablock
Don't guess which dependencies or runtime engines are running in your environment. Packablock creates an immutable cryptographic ledger (`packablock.yaml`) for every dependency lockfile modification.
Start Free Supply Chain Attestation →