PT-2025-22646 · Openssl+2 · Openssl+2

Alicja Kario + 1 · Published 2025-05-14 · Updated 2025-07-07 · CVE-2025-27587

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions openssl-3 (affected versions not specified)

Description The issue concerns a timing side channel vulnerability in the P-384 implementation when used with ECDSA in the PPC architecture. Additionally, there is a missing null pointer check before accessing handshake func in ssl lib.c. This could potentially lead to security issues. There is also an issue with Disabling EMS in OpenSSL configuration, which prevents sshd from starting.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-385

Related Identifiers

CVE-2025-27587

ECHO-3213-E8F7-97F9

OPENSUSE-SU-2025:15183-1

OPENSUSE-SU-2025_1550-1

SUSE-SU-2025:02042-1

SUSE-SU-2025:02236-1

SUSE-SU-2025:1550-1

SUSE-SU-2025:20406-1

SUSE-SU-2025:20417-1

SUSE-SU-2025_02042-1

SUSE-SU-2025_02236-1

SUSE-SU-2025_1550-1

Affected Products

Debian

Openssl

Suse

References · 38

• https://cve.org/CVERecord?id=CVE-2025-27587 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:02236-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-27587 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-27587 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:20417-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27587 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1550-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02042-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27587 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:20406-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-27587 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15183-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-27587 · Vendor Advisory
• https://github.com/openssl/openssl/issues/24253 · Note
• https://github.com/openssl/openssl/commit/080c6be0b102934bf66daeac70f0863f209f8d0f · Note