Skip to content
OpenAdvisories
High DSA-6015-1 2 CVEs

openssl - security update

Published Oct 1, 2025 · Updated Oct 1, 2025

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 12 openssl 3.0.17-1~deb12u3
Debian · 13 openssl 3.5.1-1+deb13u1

Vulnerabilities 2

  • Critical 9.8
    CVE-2025-9230

    Out-of-bounds read & write in RFC 3211 KEK Unwrap

    Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2025-9232

    Out-of-bounds read in HTTP client no_proxy handling

    Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An ou…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi