OpenSSL Warns of Critical Vulnerabilities Affecting Multiple Versions
The OpenSSL Project has issued a critical security advisory, warning of three significant vulnerabilities affecting various versions of OpenSSL. These flaws could allow attackers to execute remote code, cause denial of service attacks, and compromise sensitive cryptographic services. Organizations using custom cryptographic providers with SM2 support are urged to prioritize immediate patching.
The most severe vulnerability, CVE-2025-9230, involves improper handling of CMS message decryption in OpenSSL versions 3.5 to 1.0.2. This could lead to out-of-bounds memory operations, potentially allowing attackers to execute arbitrary code or cause system crashes.
Another critical issue, CVE-2025-9231, is a timing side-channel vulnerability in the SM2 cryptographic services algorithm implementation on 64-bit ARM platforms. This could allow remote attackers to recover private keys through timing analysis, compromising the security of systems using these platforms.
Lastly, CVE-2025-9232 involves out-of-bounds read operations in HTTP client no_proxy handling for IPv6 addresses. While presenting a lower risk with denial-of-service impact only, it's still crucial to address this vulnerability to prevent potential disruptions in service.
The OpenSSL Project has urged users to upgrade to patched versions immediately to mitigate these risks. Affected versions include OpenSSL 3.5, 3.4, 3.3, 3.2, 3.0, 1.1.1, and 1.0.2. Organizations are advised to prioritize patching, especially those using custom cryptographic services providers with SM2 support, to prevent unauthorized access and maintain the integrity of their systems.
Read also:
- "Eco-Scam": Unveiling the Truth about Electric Vehicles
- European transportation's sustainability and competitiveness rely on a "green industrial agreement" that serves the interests of both corporations and residents, as discussed in an Editorial from August 2024.
- Indian Oil Corporation's Panipat Refinery secures India's inaugural ISCC CORSIA accreditation for Sustainable Aviation Fuel production
- Porsche Macan Accelerates into Second Generation of Electric Power
