PT-2025-39986 · Openssl+12 · Openssl+12
Stanislav Fort
+1
·
Published
2025-09-30
·
Updated
2026-03-10
·
CVE-2025-9230
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
OpenSSL versions prior to 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.1.1zd, and 1.0.2zm.
Description:
OpenSSL contains vulnerabilities due to out-of-bounds read and write issues. Specifically, an out-of-bounds read and write can occur when decrypting CMS messages encrypted using password-based encryption, potentially leading to a crash or memory corruption. Additionally, an out-of-bounds read can occur in the HTTP client API functions when the 'no proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. The FIPS modules in OpenSSL versions 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected.
Recommendations:
Upgrade OpenSSL to version 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.1.1zd, or 1.0.2zm to address these vulnerabilities.
Fix
DoS
RCE
Out of bounds Read
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Debian
Freebsd
Ibm Aix
Linuxmint
Mysql Server
Openssl
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu