UBUNTU-CVE-2025-9230: Critical severity ubuntu/openssl vulnerability

Q: Which deployments are realistically exposed?

Applications that decrypt CMS messages using password-based (PWRI) encryption are exposed. PWRI support in CMS messages is described as very rarely used, so applications that do not process this message type are not in the affected usage path.

Q: What would an attacker need to do to trigger the issue?

An attacker would need to cause an application to decrypt a CMS message encrypted with password-based encryption. The supplied severity vector indicates network exploitation requires no privileges or user interaction, although the probability of successfully exploiting the memory corruption is described as low.

Q: Are OpenSSL FIPS modules affected?

The FIPS modules in versions 3.5, 3.4, 3.3, 3.2, 3.1, and 3.0 are not affected. The CMS implementation is outside the OpenSSL FIPS module boundary.

Published Sep 30, 2025

Updated

Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.

Affected Software

23 affected componentsFixes available

ubuntu/openssl<1.0.1f-1ubuntu2.27+esm11

1.0.1f-1ubuntu2.27+esm11

ubuntu/openssl<1.0.2g-1ubuntu4.20+esm13

1.0.2g-1ubuntu4.20+esm13

ubuntu/nodejs*

ubuntu/openssl<1.0.2g-1ubuntu4.fips.4.20.13

1.0.2g-1ubuntu4.fips.4.20.13

ubuntu/openssl*

ubuntu/openssl<1.1.1-1ubuntu2.1~18.04.23+esm6

1.1.1-1ubuntu2.1~18.04.23+esm6

ubuntu/openssl1.0<1.0.2n-1ubuntu5.13+esm2

1.0.2n-1ubuntu5.13+esm2

ubuntu/nodejs*

ubuntu/openssl<1.1.1-1ubuntu2.fips.2.1~18.04.23.6

1.1.1-1ubuntu2.fips.2.1~18.04.23.6

ubuntu/openssl*

ubuntu/openssl<1.1.1f-1ubuntu2.24+esm1

1.1.1f-1ubuntu2.24+esm1

ubuntu/openssl<1.1.1f-1ubuntu2.fips.24.1

1.1.1f-1ubuntu2.fips.24.1

ubuntu/openssl*

ubuntu/openssl<3.0.2-0ubuntu1.20

3.0.2-0ubuntu1.20

ubuntu/nodejs*

ubuntu/openssl*

ubuntu/openssl-fips*

ubuntu/openssl<3.0.2-0ubuntu1.20+Fips1

3.0.2-0ubuntu1.20+Fips1

ubuntu/openssl-fips*

ubuntu/openssl<3.0.13-0ubuntu3.6

3.0.13-0ubuntu3.6

ubuntu/openssl-fips<3.0.13-0ubuntu3.6+Fips1

3.0.13-0ubuntu3.6+Fips1

ubuntu/openssl<3.5.3-1ubuntu2

3.5.3-1ubuntu2

ubuntu/openssl<3.5.3-1ubuntu2

3.5.3-1ubuntu2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/openssl to a version that resolves this vulnerability.
Fixed in 1.0.1f-1ubuntu2.27+esm11
Upgrade
Upgrade ubuntu/openssl to a version that resolves this vulnerability.
Fixed in 1.0.2g-1ubuntu4.20+esm13
Upgrade
Upgrade ubuntu/openssl to a version that resolves this vulnerability.
Fixed in 1.0.2g-1ubuntu4.fips.4.20.13
Upgrade
Upgrade ubuntu/openssl to a version that resolves this vulnerability.
Fixed in 1.1.1-1ubuntu2.1~18.04.23+esm6
Upgrade
Upgrade ubuntu/openssl1.0 to a version that resolves this vulnerability.
Fixed in 1.0.2n-1ubuntu5.13+esm2
Upgrade
Upgrade ubuntu/openssl to a version that resolves this vulnerability.
Fixed in 1.1.1-1ubuntu2.fips.2.1~18.04.23.6
Upgrade
Upgrade ubuntu/openssl to a version that resolves this vulnerability.
Fixed in 1.1.1f-1ubuntu2.24+esm1
Upgrade
Upgrade ubuntu/openssl to a version that resolves this vulnerability.
Fixed in 1.1.1f-1ubuntu2.fips.24.1
Upgrade
Upgrade ubuntu/openssl to a version that resolves this vulnerability.
Fixed in 3.0.2-0ubuntu1.20
Upgrade
Upgrade ubuntu/openssl to a version that resolves this vulnerability.
Fixed in 3.0.2-0ubuntu1.20+Fips1
Upgrade
Upgrade ubuntu/openssl to a version that resolves this vulnerability.
Fixed in 3.0.13-0ubuntu3.6
Upgrade
Upgrade ubuntu/openssl-fips to a version that resolves this vulnerability.
Fixed in 3.0.13-0ubuntu3.6+Fips1
Upgrade
Upgrade ubuntu/openssl to a version that resolves this vulnerability.
Fixed in 3.5.3-1ubuntu2

Event History

Sep 30, 2025

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are realistically exposed?

Applications that decrypt CMS messages using password-based (PWRI) encryption are exposed. PWRI support in CMS messages is described as very rarely used, so applications that do not process this message type are not in the affected usage path.

What would an attacker need to do to trigger the issue?

An attacker would need to cause an application to decrypt a CMS message encrypted with password-based encryption. The supplied severity vector indicates network exploitation requires no privileges or user interaction, although the probability of successfully exploiting the memory corruption is described as low.

Are OpenSSL FIPS modules affected?

The FIPS modules in versions 3.5, 3.4, 3.3, 3.2, 3.1, and 3.0 are not affected. The CMS implementation is outside the OpenSSL FIPS module boundary.

UBUNTU-CVE-2025-9230: Critical severity ubuntu/openssl vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed?

What would an attacker need to do to trigger the issue?

Are OpenSSL FIPS modules affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed?

What would an attacker need to do to trigger the issue?

Are OpenSSL FIPS modules affected?