Moderate Security Vulnerability in compat-openssl11: Arbitrary Code Execution Risk
Summary
ALSA-2026:4472: Moderate: compat-openssl11 security update. Affects compat-openssl11 versions < 1:1.1.1k-5.el9_7.1. Fixed in 1:1.1.1k-5.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The compat-openssl11 package is a compatibility layer for the OpenSSL toolkit, which is essential for secure communications between machines. This package includes libraries from the OpenSSL 1.1.1 version, enabling applications that depend on older OpenSSL versions to function correctly. However, this compatibility can also expose systems to vulnerabilities present in older versions.
Vulnerability Detail
The vulnerability identified as CVE-2025-69419 is an out-of-bounds write issue in the PKCS#12 processing of the OpenSSL toolkit. This flaw allows an attacker to execute arbitrary code on the affected system, potentially leading to unauthorized access, data breaches, or system compromise. The vulnerability arises from improper handling of input data, which can be exploited by crafting malicious PKCS#12 files.
How To Fix
Minimum fixed version
1:1.1.1k-5.el9_7.1
This is the first release that contains the fix.
sudo dnf update compat-openssl11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to systems using the affected package and monitoring for any unusual activity. Additionally, avoid processing untrusted PKCS#12 files until the package is updated.
Conclusion
The compat-openssl11 package has a moderate security vulnerability (CVE-2025-69419) that can lead to arbitrary code execution. It is crucial to update to the latest patched version to protect your systems. Utilize tools like Vulert to monitor for vulnerabilities in your applications effectively.
See every vulnerability recorded for compat-openssl11 →
FAQ
CVE-2025-69419 is a security vulnerability in the OpenSSL toolkit that allows for arbitrary code execution due to an out-of-bounds write in PKCS#12 processing.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability can lead to unauthorized access, data breaches, or complete system compromise, depending on the attacker's capabilities.
Yes, a patched version of the compat-openssl11 package is available. Update to version 1:1.1.1k-5.el9_7.1 or later to mitigate the risk.
If you cannot update the package right away, restrict access to the affected systems and avoid processing untrusted PKCS#12 files until the update is applied.
Related vulnerabilities
Recent vulnerabilities recorded for compat-openssl11.
