New OpenSSL Vulnerabilities Expose Systems to Key Theft and Remote Code Execution

🔓 CVE-2025-9230: Code Execution Vulnerability

This vulnerability is an out-of-bounds read and write issue that occurs when an application attempts to decrypt CMS (Cryptographic Message Syntax) messages using password-based encryption (PWRI) . An attacker could exploit this flaw by crafting a malicious CMS message.

• Impact: The out-of-bounds read can cause the application to crash, leading to a Denial of Service. More critically, the out-of-bounds write can corrupt memory, potentially allowing an attacker to execute arbitrary code on the system .

• Exploitability: Although the potential impact is severe, the OpenSSL project rates it as Moderate severity because the attack is complex and relies on the use of the rarely implemented PWRI feature in CMS . The FIPS modules are unaffected as the CMS code lies outside their boundary .

🗝️ CVE-2025-9231: Private Key Recovery Vulnerability

This flaw is a timing side-channel vulnerability specifically in the implementation of the SM2 cryptographic algorithm on 64-bit ARM platforms . By performing precise timing measurements of the SM2 signature process, an attacker could potentially deduce the private key .

• Impact: Successful exploitation could lead to the recovery of a private SM2 key. An attacker with this key could decrypt sensitive communications or impersonate the legitimate key holder .

• Exploitability: The vulnerability is rated Moderate because its use in common scenarios like TLS is limited. OpenSSL does not natively support certificates with SM2 keys in TLS. However, the risk becomes relevant if an application uses a custom cryptographic provider that enables SM2 . This issue only affects 64-bit ARM systems and does not impact OpenSSL FIPS modules, as SM2 is not an approved algorithm .

🌐 CVE-2025-9232: Denial-of-Service Vulnerability

This is an out-of-bounds read vulnerability in the OpenSSL HTTP client. It can be triggered if the no_proxy environment variable is set and the application processes a URL where the host is an IPv6 address .

• Impact: The out-of-bounds read can trigger a crash, leading to a Denial of Service for the application using the OpenSSL client . The vulnerability is limited to a crash and does not allow for code execution.

• Exploitability: Rated Low severity because several conditions must be met for a successful attack: the no_proxy variable must be set, and the application must pass an attacker-controlled URL with an IPv6 address to the vulnerable OpenSSL function . The HTTP client is used by OCSP and CMP clients, but the URLs for these are typically not attacker-controlled .

🛡️ Mitigation and Immediate Actions

The primary and most critical step to protect your systems is to apply the available patches immediately. The following versions contain fixes for all these vulnerabilities :

• Upgrade to OpenSSL 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.1.1zd, or 1.0.2zm

For operating systems that package OpenSSL, use their standard update mechanisms. For example, Ubuntu has already released fixes for its affected versions .

The discovery of these vulnerabilities underscores the continuous need for proactive software maintenance. While the direct risk may be limited for some users due to specific technical preconditions, the potential consequences of inaction are severe. By promptly applying the provided patches, you can secure your systems against these threats and maintain the integrity of your encrypted communications.

NOTE: Securetron PKI Trust Manager and Trust Cloud are NOT affected by these vulnerabilities.