CVE-2025-9230

Name
CVE-2025-9230
Description
Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
patch https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45
patch https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280
patch https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def
patch https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd
patch https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482
patch https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3
patch https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba
vendor-advisory https://openssl-library.org/news/secadv/20250930.txt
af854a3a-2127-422b-91ae-364da2661108 https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html
af854a3a-2127-422b-91ae-364da2661108 http://www.openwall.com/lists/oss-security/2025/09/30/5

Match rules

CPE URI Source package Min version Max version
openssl >= 3.5.0 < 3.5.4
openssl >= 3.4.0 < 3.4.3
openssl >= 3.3.0 < 3.3.5
openssl >= 3.2.0 < 3.2.6
openssl >= 3.0.0 < 3.0.18
openssl >= 1.1.1 < 1.1.1zd
openssl >= 1.0.2 < 1.0.2zm

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
openssl edge-main 3.5.4-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
openssl edge-main 3.5.3-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.5.3-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.5.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.5.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.5.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.3.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.3.2-r6 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.3.2-r5 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.3.2-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.3.2-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.3.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.3.1-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.3.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.3.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.3.0-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.3.0-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.2.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.0.8-r0 Ariadne Conill <ariadne@dereferenced.org> possibly vulnerable
openssl edge-main 3.0.7-r2 Ariadne Conill <ariadne@dereferenced.org> possibly vulnerable
openssl edge-main 3.0.7-r0 Ariadne Conill <ariadne@dereferenced.org> possibly vulnerable
openssl edge-main 3.0.6-r0 Ariadne Conill <ariadne@dereferenced.org> possibly vulnerable
openssl edge-main 3.0.5-r0 None possibly vulnerable
openssl edge-main 3.0.3-r0 None possibly vulnerable
openssl edge-main 3.0.2-r0 None possibly vulnerable
openssl edge-main 3.0.1-r0 None possibly vulnerable
openssl edge-main 1.1.1q-r0 Timo Teras <timo.teras@iki.fi> possibly vulnerable
openssl edge-main 1.1.1o-r0 Timo Teras <timo.teras@iki.fi> possibly vulnerable
openssl edge-main 1.1.1n-r0 Timo Teras <timo.teras@iki.fi> possibly vulnerable
openssl edge-main 1.1.1l-r0 Timo Teras <timo.teras@iki.fi> possibly vulnerable
openssl edge-main 1.1.1k-r0 Timo Teras <timo.teras@iki.fi> possibly vulnerable
openssl edge-main 1.1.1j-r0 None possibly vulnerable
openssl edge-main 1.1.1i-r0 None possibly vulnerable
openssl edge-main 1.1.1g-r0 None possibly vulnerable
openssl edge-main 1.1.1d-r3 None possibly vulnerable
openssl edge-main 1.1.1d-r1 None possibly vulnerable
openssl edge-main 1.1.1b-r1 None possibly vulnerable
openssl edge-main 1.1.1a-r0 None possibly vulnerable
openssl 3.23-main 3.5.4-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
openssl 3.22-main 3.5.4-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
openssl 3.22-main 3.5.3-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.22-main 3.5.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.22-main 3.5.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.22-main 3.5.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.22-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.22-main 3.3.3-r0 None possibly vulnerable
openssl 3.22-main 3.3.2-r5 None possibly vulnerable
openssl 3.22-main 3.3.2-r3 None possibly vulnerable
openssl 3.22-main 3.3.2-r0 None possibly vulnerable
openssl 3.22-main 3.3.1-r1 None possibly vulnerable
openssl 3.22-main 3.3.0-r3 None possibly vulnerable
openssl 3.22-main 3.3.0-r2 None possibly vulnerable
openssl 3.22-main 3.2.1-r2 None possibly vulnerable
openssl 3.22-main 3.0.8-r0 None possibly vulnerable
openssl 3.22-main 3.0.7-r2 None possibly vulnerable
openssl 3.22-main 3.0.7-r0 None possibly vulnerable
openssl 3.22-main 3.0.6-r0 None possibly vulnerable
openssl 3.22-main 3.0.5-r0 None possibly vulnerable
openssl 3.22-main 3.0.3-r0 None possibly vulnerable
openssl 3.22-main 3.0.2-r0 None possibly vulnerable
openssl 3.22-main 3.0.1-r0 None possibly vulnerable
openssl 3.22-main 1.1.1l-r0 None possibly vulnerable
openssl 3.22-main 1.1.1k-r0 None possibly vulnerable
openssl 3.22-main 1.1.1j-r0 None possibly vulnerable
openssl 3.22-main 1.1.1i-r0 None possibly vulnerable
openssl 3.22-main 1.1.1g-r0 None possibly vulnerable
openssl 3.22-main 1.1.1d-r3 None possibly vulnerable
openssl 3.22-main 1.1.1d-r1 None possibly vulnerable
openssl 3.22-main 1.1.1b-r1 None possibly vulnerable
openssl 3.22-main 1.1.1a-r0 None possibly vulnerable
openssl 3.21-main 3.3.5-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
openssl 3.21-main 3.3.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.21-main 3.3.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.21-main 3.3.2-r6 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.21-main 3.3.2-r5 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.21-main 3.3.2-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.21-main 3.3.2-r3 None possibly vulnerable
openssl 3.21-main 3.3.2-r0 None possibly vulnerable
openssl 3.21-main 3.3.1-r1 None possibly vulnerable
openssl 3.21-main 3.3.0-r3 None possibly vulnerable
openssl 3.21-main 3.3.0-r2 None possibly vulnerable
openssl 3.21-main 3.2.1-r2 None possibly vulnerable
openssl 3.21-main 3.0.8-r0 None possibly vulnerable
openssl 3.21-main 3.0.7-r2 None possibly vulnerable
openssl 3.21-main 3.0.7-r0 None possibly vulnerable
openssl 3.21-main 3.0.6-r0 None possibly vulnerable
openssl 3.21-main 3.0.5-r0 None possibly vulnerable
openssl 3.21-main 3.0.3-r0 None possibly vulnerable
openssl 3.21-main 3.0.2-r0 None possibly vulnerable
openssl 3.21-main 3.0.1-r0 None possibly vulnerable
openssl 3.21-main 1.1.1l-r0 None possibly vulnerable
openssl 3.21-main 1.1.1k-r0 None possibly vulnerable
openssl 3.21-main 1.1.1j-r0 None possibly vulnerable
openssl 3.21-main 1.1.1i-r0 None possibly vulnerable
openssl 3.21-main 1.1.1g-r0 None possibly vulnerable
openssl 3.21-main 1.1.1d-r3 None possibly vulnerable
openssl 3.21-main 1.1.1d-r1 None possibly vulnerable
openssl 3.21-main 1.1.1b-r1 None possibly vulnerable
openssl 3.21-main 1.1.1a-r0 None possibly vulnerable
openssl 3.20-main 3.3.5-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
openssl 3.20-main 3.3.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.20-main 3.3.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.20-main 3.3.2-r3 None possibly vulnerable
openssl 3.20-main 3.3.2-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.20-main 3.3.2-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.20-main 3.3.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.20-main 3.3.1-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.20-main 3.3.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.20-main 3.3.0-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.20-main 3.3.0-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.20-main 3.2.1-r2 None possibly vulnerable
openssl 3.20-main 3.0.8-r0 None possibly vulnerable
openssl 3.20-main 3.0.7-r2 None possibly vulnerable
openssl 3.20-main 3.0.7-r0 None possibly vulnerable
openssl 3.20-main 3.0.6-r0 None possibly vulnerable
openssl 3.20-main 3.0.5-r0 None possibly vulnerable
openssl 3.20-main 3.0.3-r0 None possibly vulnerable
openssl 3.20-main 3.0.2-r0 None possibly vulnerable
openssl 3.20-main 3.0.1-r0 None possibly vulnerable
openssl 3.20-main 1.1.1l-r0 None possibly vulnerable
openssl 3.20-main 1.1.1k-r0 None possibly vulnerable
openssl 3.20-main 1.1.1j-r0 None possibly vulnerable
openssl 3.20-main 1.1.1i-r0 None possibly vulnerable
openssl 3.20-main 1.1.1g-r0 None possibly vulnerable
openssl 3.20-main 1.1.1d-r3 None possibly vulnerable
openssl 3.20-main 1.1.1d-r1 None possibly vulnerable
openssl 3.20-main 1.1.1b-r1 None possibly vulnerable
openssl 3.20-main 1.1.1a-r0 None possibly vulnerable
openssl 3.19-main 3.1.8-r1 Ariadne Conill <ariadne@dereferenced.org> fixed
openssl 3.19-main 3.0.8-r0 None possibly vulnerable
openssl 3.19-main 3.0.7-r2 None possibly vulnerable
openssl 3.19-main 3.0.7-r0 None possibly vulnerable
openssl 3.19-main 3.0.6-r0 None possibly vulnerable
openssl 3.19-main 3.0.5-r0 None possibly vulnerable
openssl 3.19-main 3.0.3-r0 None possibly vulnerable
openssl 3.19-main 3.0.2-r0 None possibly vulnerable
openssl 3.19-main 3.0.1-r0 None possibly vulnerable
openssl 3.19-main 1.1.1l-r0 None possibly vulnerable
openssl 3.19-main 1.1.1k-r0 None possibly vulnerable
openssl 3.19-main 1.1.1j-r0 None possibly vulnerable
openssl 3.19-main 1.1.1i-r0 None possibly vulnerable
openssl 3.19-main 1.1.1g-r0 None possibly vulnerable
openssl 3.19-main 1.1.1d-r3 None possibly vulnerable
openssl 3.19-main 1.1.1d-r1 None possibly vulnerable
openssl 3.19-main 1.1.1b-r1 None possibly vulnerable
openssl 3.19-main 1.1.1a-r0 None possibly vulnerable
libressl edge-community 4.1.1-r0 Orion <systmkor@gmail.com> fixed
libressl 3.22-community 4.1.1-r0 Orion <systmkor@gmail.com> fixed