Moderate Vulnerability in OpenSSL: Out-of-Bounds Read & Write in RFC 3211 KEK Unwrap
Summary
ALSA-2026:0337: Moderate: openssl security update. Affects openssl versions < 1:1.1.1k-14.el8_10. Fixed in 1:1.1.1k-14.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely-used toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, along with a comprehensive general-purpose cryptography library. It is integral to securing communications over computer networks. The package is crucial for various applications that require secure data transmission. However, vulnerabilities in OpenSSL can expose systems to significant security risks, making it essential to maintain updated versions.
Vulnerability Detail
The vulnerability identified as CVE-2025-9230 involves an out-of-bounds read and write in the RFC 3211 KEK Unwrap process. This flaw can lead to unauthorized access to sensitive data or even allow an attacker to execute arbitrary code. The issue arises from improper handling of data, which can be exploited if an attacker sends specially crafted input to the affected OpenSSL functions. The ramifications of this vulnerability can be severe, potentially compromising the integrity and confidentiality of data transmitted over secure channels.
How To Fix
Minimum fixed version
1:1.1.1k-14.el8_10
This is the first release that contains the fix.
sudo dnf update opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if immediate updating is not feasible, consider restricting access to the affected OpenSSL services or using alternative libraries for cryptographic functions until the update can be applied. However, this is not a long-term solution and should be addressed as soon as possible.
Conclusion
The OpenSSL vulnerability CVE-2025-9230 poses a moderate risk due to its potential for out-of-bounds read and write operations. It is crucial for users to update their OpenSSL packages to the latest version to mitigate risks. Regular monitoring and prompt updates are essential for maintaining security in applications that rely on OpenSSL.
See every vulnerability recorded for openssl →
FAQ
CVE-2025-9230 is a vulnerability in OpenSSL that allows for out-of-bounds read and write operations, potentially leading to unauthorized access or arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The impacts can include data breaches, unauthorized access to sensitive information, and the possibility of remote code execution, which can compromise the entire system.
Yes, a patch is available in the form of an updated version of OpenSSL: 1:1.1.1k-14.el8_10.
If you cannot update immediately, consider restricting access to the affected services or using alternative libraries until you can apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
