Skip to content

Commit 17d08b9

Browse files
t8mt8m
committed
Add JSON and secadv file for September 30th 2025 release
1 parent b1fd835 commit 17d08b9

File tree

4 files changed

+649
-0
lines changed

4 files changed

+649
-0
lines changed

‎secadv/20250930.txt‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
OpenSSL Security Advisory [30th September 2025]
2+
===============================================
3+
4+
Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230)
5+
=================================================================
6+
7+
Severity: Moderate
8+
9+
Issue summary: An application trying to decrypt CMS messages encrypted using
10+
password based encryption can trigger an out-of-bounds read and write.
11+
12+
Impact summary: This out-of-bounds read may trigger a crash which leads to
13+
Denial of Service for an application. The out-of-bounds write can cause
14+
a memory corruption which can have various consequences including
15+
a Denial of Service or Execution of attacker-supplied code.
16+
17+
Although the consequences of a successful exploit of this vulnerability
18+
could be severe, the probability that the attacker would be able to
19+
perform it is low. Besides, password based (PWRI) encryption support in CMS
20+
messages is very rarely used. For that reason the issue was assessed as
21+
Moderate severity according to our Security Policy.
22+
23+
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
24+
issue, as the CMS implementation is outside the OpenSSL FIPS module
25+
boundary.
26+
27+
OpenSSL 3.5, 3.4, 3.3, 3.2, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
28+
29+
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.4.
30+
31+
OpenSSL 3.4 users should upgrade to OpenSSL 3.4.3.
32+
33+
OpenSSL 3.3 users should upgrade to OpenSSL 3.3.5.
34+
35+
OpenSSL 3.2 users should upgrade to OpenSSL 3.2.6.
36+
37+
OpenSSL 3.0 users should upgrade to OpenSSL 3.0.18.
38+
39+
OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zd.
40+
(premium support customers only)
41+
42+
OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zm.
43+
(premium support customers only)
44+
45+
This issue was reported on 9th August 2025 by Stanislav Fort (Aisle Research).
46+
The fix was developed by Stanislav Fort (Aisle Research) and Viktor Dukhovni.
47+
48+
49+
Timing side-channel in SM2 algorithm on 64 bit ARM (CVE-2025-9231)
50+
=================================================================
51+
52+
Severity: Moderate
53+
54+
Issue summary: A timing side-channel which could potentially allow remote
55+
recovery of the private key exists in the SM2 algorithm implementation on 64 bit
56+
ARM platforms.
57+
58+
Impact summary: A timing side-channel in SM2 signature computations on 64 bit
59+
ARM platforms could allow recovering the private key by an attacker.
60+
61+
While remote key recovery over a network was not attempted by the reporter,
62+
timing measurements revealed a timing signal which may allow such an attack.
63+
64+
OpenSSL does not directly support certificates with SM2 keys in TLS, and so
65+
this CVE is not relevant in most TLS contexts. However, given that it is
66+
possible to add support for such certificates via a custom provider, coupled
67+
with the fact that in such a custom provider context the private key may be
68+
recoverable via remote timing measurements, we consider this to be a Moderate
69+
severity issue.
70+
71+
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
72+
issue, as SM2 is not an approved algorithm.
73+
74+
OpenSSL 3.1, 3.0, 1.1.1 and 1.0.2 are not vulnerable to this issue.
75+
76+
OpenSSL 3.5, 3.4, 3.3, and 3.2 are vulnerable to this issue.
77+
78+
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.4.
79+
80+
OpenSSL 3.4 users should upgrade to OpenSSL 3.4.3.
81+
82+
OpenSSL 3.3 users should upgrade to OpenSSL 3.3.5.
83+
84+
OpenSSL 3.2 users should upgrade to OpenSSL 3.2.6.
85+
86+
This issue was reported on 18th August 2025 by Stanislav Fort (Aisle Research)
87+
The fix was developed by Stanislav Fort.
88+
89+
Out-of-bounds read in HTTP client no_proxy handling (CVE-2025-9232)
90+
===================================================================
91+
92+
Severity: Low
93+
94+
Issue summary: An application using the OpenSSL HTTP client API functions may
95+
trigger an out-of-bounds read if the "no_proxy" environment variable is set and
96+
the host portion of the authority component of the HTTP URL is an IPv6 address.
97+
98+
Impact summary: An out-of-bounds read can trigger a crash which leads to
99+
Denial of Service for an application.
100+
101+
The OpenSSL HTTP client API functions can be used directly by applications
102+
but they are also used by the OCSP client functions and CMP (Certificate
103+
Management Protocol) client implementation in OpenSSL. However the URLs used
104+
by these implementations are unlikely to be controlled by an attacker.
105+
106+
In this vulnerable code the out of bounds read can only trigger a crash.
107+
Furthermore the vulnerability requires an attacker-controlled URL to be
108+
passed from an application to the OpenSSL function and the user has to have
109+
a "no_proxy" environment variable set. For the aforementioned reasons the
110+
issue was assessed as Low severity.
111+
112+
The vulnerable code was introduced in the following patch releases:
113+
3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.
114+
115+
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
116+
issue, as the HTTP client implementation is outside the OpenSSL FIPS module
117+
boundary.
118+
119+
OpenSSL 3.5, 3.4, 3.3, 3.2 and 3.0 are vulnerable to this issue.
120+
121+
OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.
122+
123+
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.4.
124+
125+
OpenSSL 3.4 users should upgrade to OpenSSL 3.4.3.
126+
127+
OpenSSL 3.3 users should upgrade to OpenSSL 3.3.5.
128+
129+
OpenSSL 3.2 users should upgrade to OpenSSL 3.2.6.
130+
131+
OpenSSL 3.0 users should upgrade to OpenSSL 3.0.18.
132+
133+
This issue was reported on 16th August 2025 by Stanislav Fort (Aisle Research).
134+
The fix was developed by Stanislav Fort (Aisle Research).
135+
136+
General Advisory Notes
137+
======================
138+
139+
URL for this Security Advisory:
140+
https://openssl-library.org/news/secadv/20250930.txt
141+
142+
Note: the online version of the advisory may be updated with additional details
143+
over time.
144+
145+
For details of OpenSSL severity classifications please see:
146+
https://openssl-library.org/policies/general/security-policy/

‎secjson/CVE-2025-9230.json‎

Lines changed: 195 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
{
2+
"containers": {
3+
"cna": {
4+
"affected": [
5+
{
6+
"defaultStatus": "unaffected",
7+
"product": "OpenSSL",
8+
"vendor": "OpenSSL",
9+
"versions": [
10+
{
11+
"lessThan": "3.5.4",
12+
"status": "affected",
13+
"version": "3.5.0",
14+
"versionType": "semver"
15+
},
16+
{
17+
"lessThan": "3.4.3",
18+
"status": "affected",
19+
"version": "3.4.0",
20+
"versionType": "semver"
21+
},
22+
{
23+
"lessThan": "3.3.5",
24+
"status": "affected",
25+
"version": "3.3.0",
26+
"versionType": "semver"
27+
},
28+
{
29+
"lessThan": "3.2.6",
30+
"status": "affected",
31+
"version": "3.2.0",
32+
"versionType": "semver"
33+
},
34+
{
35+
"lessThan": "3.0.18",
36+
"status": "affected",
37+
"version": "3.0.0",
38+
"versionType": "semver"
39+
},
40+
{
41+
"lessThan": "1.1.1zd",
42+
"status": "affected",
43+
"version": "1.1.1",
44+
"versionType": "custom"
45+
},
46+
{
47+
"lessThan": "1.0.2zm",
48+
"status": "affected",
49+
"version": "1.0.2",
50+
"versionType": "custom"
51+
}
52+
]
53+
}
54+
],
55+
"credits": [
56+
{
57+
"lang": "en",
58+
"type": "reporter",
59+
"value": "Stanislav Fort (Aisle Research)"
60+
},
61+
{
62+
"lang": "en",
63+
"type": "remediation developer",
64+
"value": "Stanislav Fort (Aisle Research)"
65+
},
66+
{
67+
"lang": "en",
68+
"type": "remediation developer",
69+
"value": "Viktor Dukhovni"
70+
}
71+
],
72+
"datePublic": "2025-09-30T14:00:00.000Z",
73+
"descriptions": [
74+
{
75+
"lang": "en",
76+
"supportingMedia": [
77+
{
78+
"base64": false,
79+
"type": "text/html",
80+
"value": "Issue summary: An application trying to decrypt CMS messages encrypted using<br>password based encryption can trigger an out-of-bounds read and write.<br><br>Impact summary: This out-of-bounds read may trigger a crash which leads to<br>Denial of Service for an application. The out-of-bounds write can cause<br>a memory corruption which can have various consequences including<br>a Denial of Service or Execution of attacker-supplied code.<br><br>Although the consequences of a successful exploit of this vulnerability<br>could be severe, the probability that the attacker would be able to<br>perform it is low. Besides, password based (PWRI) encryption support in CMS<br>messages is very rarely used. For that reason the issue was assessed as<br>Moderate severity according to our Security Policy.<br><br>The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this<br>issue, as the CMS implementation is outside the OpenSSL FIPS module<br>boundary."
81+
}
82+
],
83+
"value": "Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary."
84+
}
85+
],
86+
"metrics": [
87+
{
88+
"format": "other",
89+
"other": {
90+
"content": {
91+
"text": "Moderate"
92+
},
93+
"type": "https://openssl-library.org/policies/general/security-policy/"
94+
}
95+
}
96+
],
97+
"problemTypes": [
98+
{
99+
"descriptions": [
100+
{
101+
"cweId": "CWE-125",
102+
"description": "CWE-125 Out-of-bounds Read",
103+
"lang": "en",
104+
"type": "CWE"
105+
},
106+
{
107+
"cweId": "CWE-787",
108+
"description": "CWE-787 Out-of-bounds Write",
109+
"lang": "en",
110+
"type": "CWE"
111+
}
112+
]
113+
}
114+
],
115+
"providerMetadata": {
116+
"orgId": "00000000-0000-4000-9000-000000000000",
117+
"shortName": "openssl"
118+
},
119+
"references": [
120+
{
121+
"name": "OpenSSL Advisory",
122+
"tags": [
123+
"vendor-advisory"
124+
],
125+
"url": "https://openssl-library.org/news/secadv/20250930.txt"
126+
},
127+
{
128+
"name": "3.5.4 git commit",
129+
"tags": [
130+
"patch"
131+
],
132+
"url": "https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482"
133+
},
134+
{
135+
"name": "3.4.3 git commit",
136+
"tags": [
137+
"patch"
138+
],
139+
"url": "https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280"
140+
},
141+
{
142+
"name": "3.3.5 git commit",
143+
"tags": [
144+
"patch"
145+
],
146+
"url": "https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45"
147+
},
148+
{
149+
"name": "3.2.6 git commit",
150+
"tags": [
151+
"patch"
152+
],
153+
"url": "https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd"
154+
},
155+
{
156+
"name": "3.0.18 git commit",
157+
"tags": [
158+
"patch"
159+
],
160+
"url": "https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def"
161+
},
162+
{
163+
"name": "1.1.1zd git commit",
164+
"tags": [
165+
"patch"
166+
],
167+
"url": "https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba"
168+
},
169+
{
170+
"name": "1.0.2zm git commit",
171+
"tags": [
172+
"patch"
173+
],
174+
"url": "https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3"
175+
}
176+
],
177+
"source": {
178+
"discovery": "UNKNOWN"
179+
},
180+
"title": "Out-of-bounds read & write in RFC 3211 KEK Unwrap",
181+
"x_generator": {
182+
"engine": "Vulnogram 0.2.0"
183+
}
184+
}
185+
},
186+
"cveMetadata": {
187+
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
188+
"cveId": "CVE-2025-9230",
189+
"requesterUserId": "00000000-0000-4000-9000-000000000000",
190+
"serial": 1,
191+
"state": "PUBLISHED"
192+
},
193+
"dataType": "CVE_RECORD",
194+
"dataVersion": "5.1"
195+
}

0 commit comments

Comments
 (0)