Skip to content
OpenAdvisories
Medium ELSA-2025-21248 1 CVE

Moderate: openssl security update (Oracle Linux 10)

Published Dec 2, 2025 · Updated Dec 2, 2025

Ecosystem: Oracle Linux

Summary

[3.5.1-4.0.1]
- Replace upstream references [Orabug: 34340177]
- Update FIPS provider name [Orabug: 35824276]

[1:3.5.1-4]
- Fix CVE-2025-9230
Resolves: RHEL-115885

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 10 openssl 1:3.5.1-4.0.1.el10_1
Oracle Linux · 10 openssl-devel 1:3.5.1-4.0.1.el10_1
Oracle Linux · 10 openssl-libs 1:3.5.1-4.0.1.el10_1
Oracle Linux · 10 openssl-perl 1:3.5.1-4.0.1.el10_1

Vulnerabilities 1

  • Critical 9.8
    CVE-2025-9230

    Out-of-bounds read & write in RFC 3211 KEK Unwrap

    Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi