OpenSSL Release Announcement and Security Advisory - 30th Sep 2025
OpenSSL Announce <[email protected]> Tue, 30 Sep 2025 20:30:46 +0000
| Newsgroups | gmane.comp.encryption.openssl.announce |
|---|---|
| Message-ID | <[email protected]> |
----_NmP-2da0fc991343e694-Part_1
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
OpenSSL Release Announcement and Security Advisory - 30th Sep 2025
OPENSSL RELEASE ANNOUNCEMENT AND SECURITY ADVISORY - 30TH SEP 2025
Release Announcement for OpenSSL Library 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18=
,
1.0.2zm and 1.1.1zd
The OpenSSL Project team announces the release of =
new versions of our
open-source toolkit for SSL/TLS.
Changes and CVEs fixed in 3.5.4:
* CVE-2025-9230=C2=A0- Fix Out-of-bounds=
read & write in RFC 3211 KEK Unwrap.
* CVE-2025-9231=C2=A0- Fix Timing =
side-channel in SM2 algorithm on 64-bit ARM.
* CVE-2025-9232=C2=A0- Fix =
Out-of-bounds read in HTTP client no_proxy handling.
* Reverted the synthesised=C2=A0OPENSSL_VERSION_NUMBER=C2=A0change for the=
release
builds, as it broke some existing applications that relied on =
the previous
3.x semantics, as documented in=C2=A0OpenSSL_version(3).
CVEs fixed in 3.4.3:
* CVE-2025-9230=C2=A0- Fix Out-of-bounds read & =
write in RFC 3211 KEK Unwrap.
* CVE-2025-9231=C2=A0- Fix Timing =
side-channel in SM2 algorithm on 64-bit ARM.
* CVE-2025-9232=C2=A0- Fix =
Out-of-bounds read in HTTP client no_proxy handling.
CVEs fixed in 3.3.5:
* CVE-2025-9230=C2=A0- Fix Out-of-bounds read & write in RFC 3211 KEK =
Unwrap.
* CVE-2025-9231=C2=A0- Fix Timing side-channel in SM2 algorithm on=
64-bit ARM.
* CVE-2025-9232=C2=A0- Fix Out-of-bounds read in HTTP client =
no_proxy handling.
CVEs fixed in 3.2.6:
* CVE-2025-9230=C2=A0- Fix =
Out-of-bounds read & write in RFC 3211 KEK Unwrap.
* CVE-2025-9231=C2=A0- =
Fix Timing side-channel in SM2 algorithm on 64-bit ARM.
* CVE-2025-9232=C2=A0- Fix Out-of-bounds read in HTTP client no_proxy =
handling.
CVEs fixed in 3.0.18:
* CVE-2025-9230=C2=A0- Fix Out-of-bounds=
read & write in RFC 3211 KEK Unwrap.
* CVE-2025-9232=C2=A0- Fix =
Out-of-bounds read in HTTP client no_proxy handling.
CVEs fixed in 1.1.1zd:=C2=A0(premium support customers only)
* CVE-2025-9230=C2=A0- Fix Out-of-bounds read & write in RFC 3211 KEK =
Unwrap.
CVEs fixed in 1.0.2zm:=C2=A0(premium support customers only)
* CVE-2025-9230=C2=A0- Fix Out-of-bounds read & write in RFC 3211 KEK =
Unwrap.
All releases contain miscellaneous minor bug fixes.=C2=A0For =
details of the
changes,=C2=A0refer to the release notes for versions
1.0.2,=C2=A01.1.1,=C2=A03.0,=C2=A03.2,=C2=A03.3,=C2=A03.4,=C2=A0and 3.5.
Specific notes on upgrading from previous versions are available in =
the=C2=A0OpenSSL
Migration Guide
https://api.ourmailsender4.=
com/c/7158e772f497d064c88e0ea9d92817d8_2502cea48b45b911cd2cbbbcf1b0c77f?=
sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f9123669df1b44e75c299c024d3&aid=
=3DXp2h.
OpenSSL Library 3.x is available for download at these URLs:
* https://www.openssl.org/source/
https://api.ourmailsender4.=
com/c/15170aff88346874ece2f7cd17a5db37_11ad65c7c883ff703e6dee772e9e8bb8?=
sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f9123669df1b44e75c299c024d3&aid=
=3DXp2h
* https://github.com/openssl/openssl/releases
https://api.ourmailsender4.com/c/2b4f814e08d8faccb9c20b682153320e_c8ad2b=
f7151024378b5604882c67fcea?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f912=
3669df1b44e75c299c024d3&aid=3DXp2h
The distribution file names are for:
* OpenSSL Library 3.5.4 -=C2=A0openssl-3.5.4
https://api.ourmailsender4=
.com/c/698ae57a33a758e508b02d315a74265c_f73e2645de6282631ec1e0abf71645fe?=
sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f9123669df1b44e75c299c024d3&aid=
=3DXp2h
* OpenSSL Library 3.4.3 -=C2=A0openssl-3.4.3
https://api.ourmailsender4.com/c/64dfee66e2397df3a03be280f18c0d8d_cccaf9=
9771e1bda9b0ff58e7b8a47924?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f912=
3669df1b44e75c299c024d3&aid=3DXp2h
* OpenSSL Library 3.3.5 =
-=C2=A0openssl-3.3.5
https://api.ourmailsender4.com/c/3e1ff4b24aaa5d2448=
920bacc5495c34_26300842e639763588dc9ae5e9a995b0?sid=3D19575671a4a85cb28ba15=
02bd99ea2ba_ac937f9123669df1b44e75c299c024d3&aid=3DXp2h
* OpenSSL Library 3.2.6 -=C2=A0openssl-3.2.6
https://api.ourmailsender4=
.com/c/efcf8c3e712e99123c99e5fde96243b4_482d89761b1f640a1ad43419ab796b47?=
sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f9123669df1b44e75c299c024d3&aid=
=3DXp2h
* OpenSSL Library 3.0.18 -=C2=A0openssl-3.0.18
https://api.ourmailsender4.com/c/eee33ec344c82b0dc366e7a521c66e55_fa6a43=
5d6cb5612ecd4f65821f8d973c?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f912=
3669df1b44e75c299c024d3&aid=3DXp2h
* OpenSSL Library 1.1.1zd =
-=C2=A0openssl-1.1.1zd
https://api.ourmailsender4.=
com/c/7c10c1aa73e835c77691fcd1b067afad_3032651ba39b5bd110d58217c39ce1c6?=
sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f9123669df1b44e75c299c024d3&aid=
=3DXp2h
* OpenSSL Library 1.0.2zm -=C2=A0openssl-1.0.2zm
https://api.ourmailsender4.com/c/35770bfe91e1833424053abdff73ef8e_aad25e=
332157821812dec54d24e04fb0?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f912=
3669df1b44e75c299c024d3&aid=3DXp2h
---------------------------------------=
-----------------------------------------
SECURITY ADVISORY - 30TH =
SEPTEMBER 2025
CVE-2025-9230 - OUT-OF-BOUNDS READ & WRITE IN RFC 3211=
KEK UNWRAP
Severity: Moderate
Link for this security advisory: =
CVE-2025-9230
https://api.ourmailsender4.com/c/ea5f7c7ba9b33443d5aa6362fd92=
1493_17a32158f6cce1cfd6388754d84f1f53?sid=3D19575671a4a85cb28ba1502bd99ea2b=
a_ac937f9123669df1b44e75c299c024d3&aid=3DXp2h
Issue summary: An =
application trying to decrypt CMS messages encrypted using
password based encryption can trigger an out-of-bounds read and write.
Impact summary: This out-of-bounds read may trigger a crash which leads to
Denial of Service for an application. The out-of-bounds write can cause a =
memory
corruption which can have various consequences including a Denial of=
Service or
Execution of attacker-supplied code.
Although the consequences=
of a successful exploit of this vulnerability could be
severe, the probability that the attacker would be able to perform it is =
low.
Besides, password based (PWRI) encryption support in CMS messages is =
very rarely
used. For that reason the issue was assessed as Moderate =
severity according to
our Security Policy.
The FIPS modules in 3.5, 3.4, 3=
.3, 3.2, 3.1 and 3.0 are not affected by this
issue, as the CMS =
implementation is outside the OpenSSL FIPS module
boundary.
OpenSSL 3.5, 3.4, 3.3, 3.2, 3.0, 1.1.1 and 1.0.2 are vulnerable to this =
issue.
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.4.
OpenSSL 3.4 users should upgrade to OpenSSL 3.4.3.
OpenSSL 3.3 users should=
upgrade to OpenSSL 3.3.5.
OpenSSL 3.2 users should upgrade to OpenSSL 3.2.=
6.
OpenSSL 3.0 users should upgrade to OpenSSL 3.0.18.
OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zd.
(premium support customers only)
OpenSSL 1.0.2 users should upgrade to =
OpenSSL 1.0.2zm.
(premium support customers only)
This issue was reported =
on 9th August 2025 by Stanislav Fort (Aisle Research).
The fix was developed by Stanislav Fort (Aisle Research) and Viktor =
Dukhovni.
CVE-2025-9231 - TIMING SIDE-CHANNEL IN SM2 ALGORITHM ON 64 BIT=
ARM
Severity: Moderate
Link for this security advisory: CVE-2025-9231
https://api.ourmailsender4.com/c/b8a6cf6cded74abe6f03c01ffdaa6d1f_ac7289975=
2ca506c0c9974bd9bcb0edb?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f912366=
9df1b44e75c299c024d3&aid=3DXp2h
Issue summary: A timing side-channel which=
could potentially allow remote
recovery of the private key exists in the =
SM2 algorithm implementation on 64 bit
ARM platforms.
Impact summary: A timing side-channel in SM2 signature computations on 64 =
bit
ARM platforms could allow recovering the private key by an attacker.
While remote key recovery over a network was not attempted by the reporter,
timing measurements revealed a timing signal which may allow such an attack=
.
OpenSSL does not directly support certificates with SM2 keys in TLS, and=
so this
CVE is not relevant in most TLS contexts. =C2=A0However, given =
that it is possible to
add support for such certificates via a custom =
provider, coupled with the fact
that in such a custom provider context the =
private key may be recoverable via
remote timing measurements, we consider =
this to be a Moderate severity issue.
The FIPS modules in 3.5, 3.4, 3.3, 3=
.2, 3.1 and 3.0 are not affected by this
issue, as SM2 is not an approved =
algorithm.
OpenSSL 3.1, 3.0, 1.1.1 and 1.0.2 are not vulnerable to this =
issue.
OpenSSL 3.5, 3.4, 3.3, and 3.2 are vulnerable to this issue.
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.4.
OpenSSL 3.4 users should=
upgrade to OpenSSL 3.4.3.
OpenSSL 3.3 users should upgrade to OpenSSL 3.3.=
5.
OpenSSL 3.2 users should upgrade to OpenSSL 3.2.6.
This issue was reported on 18th August 2025 by Stanislav Fort (Aisle =
Research)
The fix was developed by Stanislav Fort.
CVE-2025-9232 - OUT-OF-BOUNDS READ IN HTTP CLIENT NO_PROXY HANDLING
Severity: Low
Link for this security advisory: CVE-2025-9232
https://api.ourmailsender4.com/c/9bfaba225274a86306671e2ccd89db0b_7c2f894bf=
e3e6ba826b81ec90d0b5b34?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f912366=
9df1b44e75c299c024d3&aid=3DXp2h
Issue summary: An application using the =
OpenSSL HTTP client API functions may
trigger an out-of-bounds read if the =
"no_proxy" environment variable is set and
the host portion of the =
authority component of the HTTP URL is an IPv6 address.
Impact summary: An out-of-bounds read can trigger a crash which leads to =
Denial
of Service for an application.
The OpenSSL HTTP client API =
functions can be used directly by applications but
they are also used by =
the OCSP client functions and CMP (Certificate Management
Protocol) client implementation in OpenSSL. However the URLs used by these
implementations are unlikely to be controlled by an attacker.
In this vulnerable code the out of bounds read can only trigger a crash.
Furthermore the vulnerability requires an attacker-controlled URL to be =
passed
from an application to the OpenSSL function and the user has to have=
a
"no_proxy" environment variable set. For the aforementioned reasons the =
issue
was assessed as Low severity.
The vulnerable code was introduced in =
the following patch releases:
3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by =
this
issue, as the HTTP client implementation is outside the OpenSSL FIPS =
module
boundary.
OpenSSL 3.5, 3.4, 3.3, 3.2 and 3.0 are vulnerable to this=
issue.
OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.4.
OpenSSL 3.4 users should=
upgrade to OpenSSL 3.4.3.
OpenSSL 3.3 users should upgrade to OpenSSL 3.3.=
5.
OpenSSL 3.2 users should upgrade to OpenSSL 3.2.6.
OpenSSL 3.0 users should upgrade to OpenSSL 3.0.18.
This issue was reported on 16th August 2025 by Stanislav Fort (Aisle =
Research).
The fix was developed by Stanislav Fort (Aisle Research).
GENERAL ADVISORY NOTES
URL for this Security Advisory:
https://openssl-library.org/news/secadv/20250930.txt
https://api.ourmailsender4.com/c/06c77c705dea4b89a92e5d5108733bff_5737516df=
a5c9b9ca87c9c1550906984?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f912366=
9df1b44e75c299c024d3&aid=3DXp2h
Note: the online version of the advisory =
may be updated with additional
details=C2=A0over time.
For details of OpenSSL severity classifications, please see:
https://openssl-library.org/policies/general/security-policy/
https://api.ourmailsender4.com/c/199dedf95fa332c0cee844e904882a24_d7b8e6e21=
b8b9538620c03e4dbf3d125?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f912366=
9df1b44e75c299c024d3&aid=3DXp2h
OpenSSL Corporation
https://api.ourmailsender4.com/c/ed313f659f9f9d042b06994f7b95df2c_5c0c1097d=
bc01252c5febe8378f16441?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f912366=
9df1b44e75c299c024d3&aid=3DXp2h,
Inc. 40 East Main Street, Newark,
New Castle County, 19711, USA
Unsubscribe
https://api.ourmailsender4.=
com/api/unsubscribe?key=3Dada15b98c21ecc52eeb8c79c44a35d9960abd2459970b0f7e=
ad8e512a98c8a3743a1bdd4aeb1e8ca6313af990467ae7f_822ae69dcbb3ab2b2dd8941e08a=
e4c52=C2=A0|=C2=A0Update
Profile
https://api.ourmailsender4.com/api/update?=
key=3Dada15b98c21ecc52eeb8c79c44a35d9960abd2459970b0f7ead8e512a98c8a3743a1b=
dd4aeb1e8ca6313af990467ae7f_822ae69dcbb3ab2b2dd8941e08ae4c52=C2=A0|=C2=A0Re=
port
Junk
https://api.ourmailsender4.com/api/junk?key=3Dada15b98c21ecc52eeb=
8c79c44a35d9960abd2459970b0f7ead8e512a98c8a3743a1bdd4aeb1e8ca6313af990467ae=
7f_822ae69dcbb3ab2b2dd8941e08ae4c52
View this email in your browser
https://api.ourmailsender4.com/templatePreview?key=3Dada15b98c21ecc52eeb8c7=
9c44a35d9960abd2459970b0f7ead8e512a98c8a3743a1bdd4aeb1e8ca6313af990467ae7f_=
822ae69dcbb3ab2b2dd8941e08ae4c52&html=3Dtrue
----_NmP-2da0fc991343e694-Part_1
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.=
w3.org/TR/html4/loose.dtd"><html ><head><style type=3D"text/css">=20
@font-face {
font-family: =
Inter;
src: url(https://cdn1.ourmailsender4.=
com/fonts/inter/Inter-Regular.ttf);
}
</style>
<style =
type=3D"text/css">=20
@font-face {
font-family: Play;
src: =
url(https://cdn1.ourmailsender4.com/fonts/play/Play-Regular.ttf);
}
</style>
<style type=3D"text/css">=20
=
@font-face {
font-family: Roboto;
src: url(https://cdn1.ourmailsender4.=
com/fonts/roboto/Roboto-Regular.ttf);
}
</style>
<style>a {color:#000000;=
text-decoration:underline; }
p {margin:10px 0; padding:0; }
td {border-collapse:collapse; }
body {color:#000000; width:100%; =
height:100%; margin:0; padding:0; font-size:14px; text-align:left; =
font-family:arial; font-weight:normal; letter-spacing:normal; =
background-color:#FFFFFF; }
table {border-collapse:collapse; =
mso-table-lspace:0pt; mso-table-rspace:0pt; }
h1, .mph1 {color:#000000; =
font-size:40px; font-style:normal; text-align:left; font-family:arial; =
font-weight:bold; line-height:normal; letter-spacing:normal; }
h2, .mph2 {color:#000000; font-size:30px; font-style:normal; =
text-align:left; font-family:arial; font-weight:bold; line-height:normal; =
letter-spacing:normal; }
h3, .mph3 {color:#000000; font-size:20px; =
font-style:normal; text-align:left; font-family:arial; font-weight:normal; =
line-height:normal; letter-spacing:normal; }
h4, .mph4 {color:#000000; =
font-size:14px; font-style:italic; text-align:left; font-family:arial; =
font-weight:bold; line-height:100%; letter-spacing:normal; }
.mpmFButt1 {font:arial; color:#FFFFFF; font-size:14px; border-radius:3px; =
background-color:#000000; }
img, a img {border:none; outline:none; =
text-decoration:none; -ms-text-size-adjust:100%; mso-line-height-rule:exact=
ly; -ms-interpolation-mode:bicubic; -webkit-text-size-adjust:100%; }
.hideInEmail {display:none !important; mso-hide:all; }
p, a, li, td, blockquote {mso-line-height-rule:exactly; }
a[href^=3Dtel], [href^=3Dsms] {color:inherit; cursor:default; =
text-decoration:none; }
a[x-apple-data-detectors] {color:inherit!important;=
font-size:inherit !important; font-family:inherit !important; =
font-weight:inherit !important; line-height:inherit !important; =
text-decoration:none !important; }
@media screen and (max-width: 640px) {.=
mobile-hide {display: none; hide-mso: all; }
.responsiveTd {width: 100% !=
important; border: none !important; display: block !important; padding: 0px=
!important; max-width: 100% !important; min-width: 100% !important; =
padding-left: 0px !important; padding-right: 0px !important; }
.responsiveTbl {width: 100% !important; border: none !important; min-width:=
100% !important; }
.mobiledesktop-hide {display: none; mso-hide: all; }
}
@media screen and (min-width: 641px) {.desktop-hide {width: 0px; height: 0;=
margin: 0 auto; display: none; mso-hide: all; overflow: hidden; font-size:=
0; max-height: 0; line-height: 0; }
.mobiledesktop-hide {display: none; =
mso-hide: all; }
}
p, a, li, td, body, table, blockquote =
{-ms-text-size-adjust:100%; -webkit-text-size-adjust:100%; }
h1, h2, h3, h4, h5, h6, .mph1, .mph2, .mph3, .mph4 {margin:0; =
display:block; padding:0; }
</style><title></title><meta name=3D"viewport" =
content=3D"width=3Ddevice-width, initial-scale=3D1, =
maximum-scale=3D1"/></head><body><div style=3D"display:none; =
max-height:0px; overflow:hidden; font-size:0px; line-height:0px; =
color:transparent; opacity:0; visibility:hidden; mso-hide:all;">
OpenSSL Release Announcement and Security Advisory - 30th Sep 2025
<div id=3D"preheaderpad" style=3D"display:none; max-height:0px; =
overflow:hidden; font-size:0px; line-height:0px; color:tran#sparent; =
opacity:0; visibility:hidden; mso-hide:all;"> =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C</div>
</div>
<div style=3D"height: 0;"><img src=3D"https://api.ourmailsender4.=
com/open/image.png?key=3Dada15b98c21ecc52eeb8c79c44a35d9960abd2459970b0f7ea=
d8e512a98c8a3743a1bdd4aeb1e8ca6313af990467ae7f_822ae69dcbb3ab2b2dd8941e08ae=
4c52" href=3D"https://api.ourmailsender4.com/openclick" title=3D"" alt=3D""=
/></div><table width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" =
class=3D"templateBody" style=3D"width: 100%; height: 100%; margin: 0; =
padding-top: 20px; padding-left: 0px; padding-right: 0px; padding-bottom: =
20px; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; " =
bgColor=3D"#FFFFFF"><tr><td valign=3D"top"><table align=3D"center" =
style=3D"width: 100%; margin: 0; max-width: 100%; " width=3D"100%" =
cellPadding=3D"0" cellSpacing=3D"0"><tr><td style=3D"padding-top: 20px; =
padding-left: 0px; padding-right: 0px; padding-bottom: 20px; =
background-color: #FFFFFF; -ms-text-size-adjust: 100%; =
-webkit-text-size-adjust: 100%; " valign=3D"top"><table align=3D"center" =
class=3D"" style=3D"margin: 0 auto; max-width: 100%; min-width: 100%; " =
width=3D"100%" cellPadding=3D"0" cellSpacing=3D"0"><tr><td align=3D"center"=
style=3D"padding-top: 0px; padding-left: 0px; padding-right: 0px; =
padding-bottom: 0px; background-size: cover; background-color: #f4f4f4; =
background-image: url(); background-repeat: repeat; background-position: =
center; " width=3D"100%" valign=3D"top"><table align=3D"center" =
class=3D"responsiveTbl" width=3D"555" cellPadding=3D"0" =
cellSpacing=3D"0"><tr><td class=3D"responsiveTd" style=3D"max-width: 100%; =
padding-top: 15px; border-style: none; border-width: 1px; padding-left: =
15px; padding-right: 15px; padding-bottom: 0px; background-size: cover; =
background-color: #ffffff; background-image: url(); background-repeat: =
repeat; background-position: center; " width=3D"100%" valign=3D"top"><table=
align=3D"center" class=3D"" style=3D"max-width: 100%; min-width: 100%; " =
width=3D"100%" cellPadding=3D"0" cellSpacing=3D"0"><tr><td =
style=3D"padding-top: 0px; padding-left: 0px; padding-right: 0px; =
padding-bottom: 20px; " width=3D"100%" valign=3D"undefined"><table =
align=3D"left" style=3D"border-collapse: collapse; mso-table-lspace: 0pt; =
mso-table-rspace: 0pt; -ms-text-size-adjust: 100%; -webkit-text-size-adjust=
: 100%; " width=3D"40%" cellPadding=3D"0" cellSpacing=3D"0"><tr><td =
style=3D"-ms-text-size-adjust: 100%; mso-line-height-rule: exactly; =
-webkit-text-size-adjust: 100%; "><img alt=3D"" src=3D"https://cdn1.=
ourmailsender4.com/userContent/38291/fileManager/42391/OpenSSL_DarkRed_Libr=
ary.png" style=3D"border: 0; height: auto !important; margin: 0; display: =
block !important; outline: none; padding: 0; border-radius: 0; =
padding-bottom: 0; vertical-align: bottom; text-decoration: none; =
-ms-interpolation-mode: bicubic; max-width: 100%; min-width: 100%; " =
title=3D"" width=3D"210" data-custom=3D""/></td></tr></table></td></tr></ta=
ble><table align=3D"center" class=3D"" style=3D"max-width: 100%; min-width:=
100%; " width=3D"100%" cellPadding=3D"0" cellSpacing=3D"0"><tr><td =
style=3D"padding-top: 0; padding-left: 0; padding-right: 0; padding-bottom:=
0; " width=3D"100%"><table align=3D"center" style=3D"max-width: 100%; " =
width=3D"100%" cellPadding=3D"0" cellSpacing=3D"0"><tr><td =
style=3D"padding-top: 20px; border-width: 0; padding-left: 0px; =
padding-right: 0px; padding-bottom: 10px; background-color: transparent; " =
width=3D"100%"><div style=3D"color: #000000; position: relative; font-size:=
14px; textAlign: left; word-break: break-word; font-family: arial; =
font-weight: normal; mso-line-height-rule: exactly; line-height: =
normal;letter-spacing: normal; "><h2><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;">OpenSSL =
Release Announcement and Security Advisory - 30th Sep =
2025</span></h2><p><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">Release Announcement =
for OpenSSL Library <strong>3.5.4</strong>, <strong>3.4.3</strong>, =
<strong>3.3.5</strong>, <strong>3.2.6</strong>, <strong>3.0.18</strong>, =
<strong>1.0.2zm</strong> and <strong>1.1.1zd</strong></span></p><p><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">The OpenSSL Project team announces the release of new =
versions of our open-source toolkit for SSL/TLS.</span></p><p><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">Changes and CVEs fixed in 3.5.4:</span></p><ul><li><sp=
an style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family=
: Roboto, sans-serif;"><a href=3D"#CVE-2025-9230" target=3D"_self" =
data-mce-href=3D"#CVE-2025-9230" style=3D"color: #000000;">CVE-2025-9230</a=
> - Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap.=
</span></li><li><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;"><a =
href=3D"#CVE-2025-9231" target=3D"_self" data-mce-href=3D"#CVE-2025-9231" =
style=3D"color: #000000;">CVE-2025-9231</a> - Fix Timing side-channel =
in SM2 algorithm on 64-bit ARM.</span></li><li><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;"><a=
href=3D"#CVE-2025-9232" target=3D"_self" data-mce-href=3D"#CVE-2025-9232" =
style=3D"color: #000000;">CVE-2025-9232</a> - Fix Out-of-bounds read =
in HTTP client no_proxy handling.</span></li><li><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">Reverted the synthesised <code>OPENSSL_VERSION_NU=
MBER</code> change for the release builds, as it broke some existing =
applications that relied on the previous 3.x semantics, as documented =
in <code>OpenSSL_version(3)</code>.</span></li></ul><p><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">CVEs fixed in 3.4.3:</span></p><ul><li><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;"><a href=3D"#CVE-2025-9230" target=3D"_self" =
data-mce-href=3D"#CVE-2025-9230" style=3D"color: #000000;">CVE-2025-9230</a=
> - Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap.=
</span></li><li><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;"><a =
href=3D"#CVE-2025-9231" target=3D"_self" data-mce-href=3D"#CVE-2025-9231" =
style=3D"color: #000000;">CVE-2025-9231</a> - Fix Timing side-channel =
in SM2 algorithm on 64-bit ARM.</span></li><li><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;"><a=
href=3D"#CVE-2025-9232" target=3D"_self" data-mce-href=3D"#CVE-2025-9232" =
style=3D"color: #000000;">CVE-2025-9232</a> - Fix Out-of-bounds read =
in HTTP client no_proxy handling.</span></li></ul><p><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">CVEs fixed in 3.3.5:</span></p><ul><li><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;"><a href=3D"#CVE-2025-9230" target=3D"_self" =
data-mce-href=3D"#CVE-2025-9230" style=3D"color: #000000;">CVE-2025-9230</a=
> - Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap.=
</span></li><li><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;"><a =
href=3D"#CVE-2025-9231" target=3D"_self" data-mce-href=3D"#CVE-2025-9231" =
style=3D"color: #000000;">CVE-2025-9231</a> - Fix Timing side-channel =
in SM2 algorithm on 64-bit ARM.</span></li><li><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;"><a=
href=3D"#CVE-2025-9232" target=3D"_self" data-mce-href=3D"#CVE-2025-9232" =
style=3D"color: #000000;">CVE-2025-9232</a> - Fix Out-of-bounds read =
in HTTP client no_proxy handling.</span></li></ul><p><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">CVEs fixed in 3.2.6:</span></p><ul><li><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;"><a href=3D"#CVE-2025-9230" target=3D"_self" =
data-mce-href=3D"#CVE-2025-9230" style=3D"color: #000000;">CVE-2025-9230</a=
> - Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap.=
</span></li><li><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;"><a =
href=3D"#CVE-2025-9231" target=3D"_self" data-mce-href=3D"#CVE-2025-9231" =
style=3D"color: #000000;">CVE-2025-9231</a> - Fix Timing side-channel =
in SM2 algorithm on 64-bit ARM.</span></li><li><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;"><a=
href=3D"#CVE-2025-9232" target=3D"_self" data-mce-href=3D"#CVE-2025-9232" =
style=3D"color: #000000;">CVE-2025-9232</a> - Fix Out-of-bounds read =
in HTTP client no_proxy handling.</span></li></ul><p><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">CVEs fixed in 3.0.18:</span></p><ul><li><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;"><a href=3D"#CVE-2025-9230" target=3D"_self" =
data-mce-href=3D"#CVE-2025-9230" style=3D"color: #000000;">CVE-2025-9230</a=
> - Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap.=
</span></li><li><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;"><a =
href=3D"#CVE-2025-9232" target=3D"_self" data-mce-href=3D"#CVE-2025-9232" =
style=3D"color: #000000;">CVE-2025-9232</a> - Fix Out-of-bounds read =
in HTTP client no_proxy handling.</span></li></ul><p><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">CVEs fixed in 1.1.1zd: <em>(premium support =
customers only)</em></span></p><ul><li><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;"><a =
href=3D"#CVE-2025-9230" target=3D"_self" data-mce-href=3D"#CVE-2025-9230" =
style=3D"color: #000000;">CVE-2025-9230</a> - Fix Out-of-bounds read =
& write in RFC 3211 KEK Unwrap.</span></li></ul><p><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">CVEs fixed in 1.0.2zm: <em>(premium support =
customers only)</em></span></p><ul><li><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;"><a =
href=3D"#CVE-2025-9230" target=3D"_self" data-mce-href=3D"#CVE-2025-9230" =
style=3D"color: #000000;">CVE-2025-9230</a> - Fix Out-of-bounds read =
& write in RFC 3211 KEK Unwrap.</span></li></ul><p><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">All releases contain miscellaneous minor bug fixes.=
For details of the changes, refer to the release notes for =
versions 1.0.2, 1.1.1, 3.0, 3.2, 3.3, 3.4,=
and 3.5.</span></p><p><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;">Specific =
notes on upgrading from previous versions are available in the <a =
href=3D"https://api.ourmailsender4.com/c/7158e772f497d064c88e0ea9d92817d8_2=
502cea48b45b911cd2cbbbcf1b0c77f?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac93=
7f9123669df1b44e75c299c024d3&aid=3DXp2h" data-mce-href=3D"https://docs.=
openssl.org/master/man7/ossl-guide-migration/" style=3D"color: =
#000000;">OpenSSL Migration Guide</a>.</span></p><p><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">OpenSSL Library 3.x is available for download at these=
URLs:</span></p><ul><li><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;"><a href=3D"https://api.=
ourmailsender4.com/c/15170aff88346874ece2f7cd17a5db37_11ad65c7c883ff703e6de=
e772e9e8bb8?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f9123669df1b44e75c2=
99c024d3&aid=3DXp2h" data-mce-href=3D"https://www.openssl.org/source/" =
style=3D"color: #000000;">https://www.openssl.org/source/</a></span></li><l=
i><span style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-f=
amily: Roboto, sans-serif;"><a href=3D"https://api.ourmailsender4.=
com/c/2b4f814e08d8faccb9c20b682153320e_c8ad2bf7151024378b5604882c67fcea?=
sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f9123669df1b44e75c299c024d3&aid=
=3DXp2h" data-mce-href=3D"https://github.com/openssl/openssl/releases" =
style=3D"color: #000000;">https://github.com/openssl/openssl/releases</a></=
span></li></ul><p><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">The distribution file =
names are for:</span></p><ul><li><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;">OpenSSL =
Library 3.5.4 - <a href=3D"https://api.ourmailsender4.=
com/c/698ae57a33a758e508b02d315a74265c_f73e2645de6282631ec1e0abf71645fe?=
sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f9123669df1b44e75c299c024d3&aid=
=3DXp2h" data-mce-href=3D"https://github.com/openssl/openssl/releases/tag/o=
penssl-3.5.4" style=3D"color: #000000;">openssl-3.5.=
4</a></span></li><li><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">OpenSSL Library 3.4.3 =
- <a href=3D"https://api.ourmailsender4.com/c/64dfee66e2397df3a03be280=
f18c0d8d_cccaf99771e1bda9b0ff58e7b8a47924?sid=3D19575671a4a85cb28ba1502bd99=
ea2ba_ac937f9123669df1b44e75c299c024d3&aid=3DXp2h" data-mce-href=3D"https:/=
/github.com/openssl/openssl/releases/tag/openssl-3.4.3" style=3D"color: =
#000000;">openssl-3.4.3</a></span></li><li><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;">OpenSSL Library 3.3.5 - <a href=3D"https://api.=
ourmailsender4.com/c/3e1ff4b24aaa5d2448920bacc5495c34_26300842e639763588dc9=
ae5e9a995b0?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f9123669df1b44e75c2=
99c024d3&aid=3DXp2h" data-mce-href=3D"https://github.=
com/openssl/openssl/releases/tag/openssl-3.3.5" style=3D"color: =
#000000;">openssl-3.3.5</a></span></li><li><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;">OpenSSL Library 3.2.6 - <a href=3D"https://api.=
ourmailsender4.com/c/efcf8c3e712e99123c99e5fde96243b4_482d89761b1f640a1ad43=
419ab796b47?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f9123669df1b44e75c2=
99c024d3&aid=3DXp2h" data-mce-href=3D"https://github.=
com/openssl/openssl/releases/tag/openssl-3.2.6" style=3D"color: =
#000000;">openssl-3.2.6</a></span></li><li><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;">OpenSSL Library 3.0.18 - <a href=3D"https://api.=
ourmailsender4.com/c/eee33ec344c82b0dc366e7a521c66e55_fa6a435d6cb5612ecd4f6=
5821f8d973c?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f9123669df1b44e75c2=
99c024d3&aid=3DXp2h" data-mce-href=3D"https://github.=
com/openssl/openssl/releases/tag/openssl-3.0.18" style=3D"color: =
#000000;">openssl-3.0.18</a></span></li><li><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;">OpenSSL Library 1.1.1zd - <a href=3D"https://api.=
ourmailsender4.com/c/7c10c1aa73e835c77691fcd1b067afad_3032651ba39b5bd110d58=
217c39ce1c6?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f9123669df1b44e75c2=
99c024d3&aid=3DXp2h" target=3D"_blank" rel=3D"noopener" =
data-mce-href=3D"https://support.openssl.org/hc/en-us/articles/298748038908=
34-Extended-Release-1-1-1zd" style=3D"color: #000000;">openssl-1.1.=
1zd</a></span></li><li><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">OpenSSL Library 1.0.2zm=
- <a href=3D"https://api.ourmailsender4.com/c/35770bfe91e1833424053ab=
dff73ef8e_aad25e332157821812dec54d24e04fb0?sid=3D19575671a4a85cb28ba1502bd9=
9ea2ba_ac937f9123669df1b44e75c299c024d3&aid=3DXp2h" target=3D"_blank" =
rel=3D"noopener" data-mce-href=3D"https://support.openssl.=
org/hc/en-us/articles/29874930724754-Extended-Release-1-0-2zm" =
style=3D"color: #000000;">openssl-1.0.2zm</a></span></li></ul><hr><h3><span=
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">Security Advisory - 30th September =
2025<br><br></span></h3><h2><a name=3D"CVE-2025-9230" =
contenteditable=3D"false" class=3D"mce-item-anchor" style=3D"color: =
#000000;"></a></h2><h4><span style=3D"text-decoration: underline;" =
data-mce-style=3D"text-decoration: underline;"><span style=3D"font-family: =
Roboto, sans-serif; color: rgb(0, 0, 0); text-decoration: underline;" =
data-mce-style=3D"font-family: Roboto, sans-serif; color: #000000; =
text-decoration: underline;">CVE-2025-9230 - Out-of-bounds read & write=
in RFC 3211 KEK Unwrap</span></span><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;"><br></span></h4><p><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;"><em>Severity</em>: <strong>Moderate<br></strong></span><em>Lin=
k for this security advisory: </em><a href=3D"https://api.ourmailsender4.=
com/c/ea5f7c7ba9b33443d5aa6362fd921493_17a32158f6cce1cfd6388754d84f1f53?=
sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f9123669df1b44e75c299c024d3&aid=
=3DXp2h" target=3D"_blank" rel=3D"noopener" data-mce-href=3D"https://www.=
openssl.org/news/vulnerabilities.html#CVE-2025-9230" style=3D"color: =
#000000;">CVE-2025-9230</a><br><br><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;"><em>Issue =
summary:</em> An application trying to decrypt CMS messages encrypted using=
password based encryption can trigger an out-of-bounds read and write.=
</span><br><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;"><em>Impact =
summary</em>: This out-of-bounds read may trigger a crash which leads to =
Denial of Service for an application. The out-of-bounds write can cause a =
memory corruption which can have various consequences including a Denial of=
Service or Execution of attacker-supplied code.</span><br><br><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">Although the consequences of a successful exploit of =
this vulnerability could be severe, the probability that the attacker would=
be able to perform it is low. Besides, password based (PWRI) encryption =
support in CMS messages is very rarely used. For that reason the issue was =
assessed as Moderate severity according to our Security Policy.=
</span><br><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">The FIPS modules in 3.5=
, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this</span><br><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">issue, as the CMS implementation is outside the =
OpenSSL FIPS module</span><br><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;">boundary.=
</span><br><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">OpenSSL 3.5, 3.4, 3.3, =
3.2, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.</span><br><br><span=
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">OpenSSL 3.5 users should upgrade to OpenSSL 3.5.4.=
</span><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">OpenSSL 3.4 users =
should upgrade to OpenSSL 3.4.3.</span><br><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;">OpenSSL 3.3 users should upgrade to OpenSSL 3.3.5.=
</span><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">OpenSSL 3.2 users =
should upgrade to OpenSSL 3.2.6.</span><br><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;">OpenSSL 3.0 users should upgrade to OpenSSL 3.0.18.=
</span><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">OpenSSL 1.1.1 users =
should upgrade to OpenSSL 1.1.1zd.</span><br><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;">(premium support customers only)</span><br><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zm.=
</span><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">(premium support =
customers only)</span><br><br><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;">This issue=
was reported on 9th August 2025 by Stanislav Fort (Aisle Research).=
</span><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">The fix was developed =
by <em>Stanislav Fort </em>(Aisle Research) and <em>Viktor Dukhovni</em>.=
</span><br><br><a class=3D"mce-item-anchor" contenteditable=3D"false" =
name=3D"CVE-2025-9231" style=3D"color: #000000;"></a></p><h4><span =
style=3D"text-decoration: underline;" data-mce-style=3D"text-decoration: =
underline;"><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">CVE-2025-9231 - Timing =
side-channel in SM2 algorithm on 64 bit ARM</span></span><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;"><br></span></h4><p><span style=3D"font-family: Roboto,=
sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;"><em>Severity</em>: <strong>Moderate</strong></span><br><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;"><em>Link for this security advisory: <a =
href=3D"https://api.ourmailsender4.com/c/b8a6cf6cded74abe6f03c01ffdaa6d1f_a=
c72899752ca506c0c9974bd9bcb0edb?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac93=
7f9123669df1b44e75c299c024d3&aid=3DXp2h" target=3D"_blank" rel=3D"noopener"=
data-mce-href=3D"https://www.openssl.org/news/vulnerabilities.=
html#CVE-2025-9231" style=3D"color: #000000;">CVE-2025-9231</a><br><br>Issu=
e summary</em>: A timing side-channel which could potentially allow remote =
recovery of the private key exists in the SM2 algorithm implementation on =
64 bit ARM platforms.</span><br><br><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;"><em>Impact=
summary</em>: A timing side-channel in SM2 signature computations on 64 =
bit ARM platforms could allow recovering the private key by an attacker. =
</span><br><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">While remote key =
recovery over a network was not attempted by the reporter, timing =
measurements revealed a timing signal which may allow such an attack.=
</span><br><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">OpenSSL does not =
directly support certificates with SM2 keys in TLS, and so this CVE is not =
relevant in most TLS contexts. However, given that it is possible to =
add support for such certificates via a custom provider, coupled with the =
fact that in such a custom provider context the private key may be =
recoverable via remote timing measurements, we consider this to be a =
Moderate severity issue.</span><br><br><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;">The FIPS =
modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by =
this</span><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">issue, as SM2 is not an=
approved algorithm.</span><br><br><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;">OpenSSL 3.=
1, 3.0, 1.1.1 and 1.0.2 are not vulnerable to this issue.</span><br><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">OpenSSL 3.5, 3.4, 3.3, and 3.2 are vulnerable to this =
issue.</span><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">OpenSSL 3.5 users =
should upgrade to OpenSSL 3.5.4.</span><br><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;">OpenSSL 3.4 users should upgrade to OpenSSL 3.4.3.=
</span><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">OpenSSL 3.3 users =
should upgrade to OpenSSL 3.3.5.</span><br><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;">OpenSSL 3.2 users should upgrade to OpenSSL 3.2.6.=
</span><br><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">This issue was reported=
on 18th August 2025 by Stanislav Fort (Aisle Research)</span><br><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">The fix was developed by <em>Stanislav Fort</em>.=
</span><br><br><a name=3D"CVE-2025-9232" contenteditable=3D"false" =
class=3D"mce-item-anchor" style=3D"color: #000000;"></a></p><h4><span =
style=3D"text-decoration: underline;" data-mce-style=3D"text-decoration: =
underline;"><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">CVE-2025-9232 - =
Out-of-bounds read in HTTP client no_proxy handling</span></span><br></h4><=
p><span style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-f=
amily: Roboto, sans-serif;"><em>Severity</em>: <strong>Low<br></strong><em>=
Link for this security advisory: </em><strong><a href=3D"https://api.=
ourmailsender4.com/c/9bfaba225274a86306671e2ccd89db0b_7c2f894bfe3e6ba826b81=
ec90d0b5b34?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f9123669df1b44e75c2=
99c024d3&aid=3DXp2h" target=3D"_blank" rel=3D"noopener" =
data-mce-href=3D"https://www.openssl.org/news/vulnerabilities.=
html#CVE-2025-9232" style=3D"color: #000000;">CVE-2025-9232</a></strong></s=
pan><br><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;"><em>Issue summary</em>:=
An application using the OpenSSL HTTP client API functions may trigger an =
out-of-bounds read if the "no_proxy" environment variable is set and the =
host portion of the authority component of the HTTP URL is an IPv6 address.=
</span><br><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;"><em>Impact =
summary</em>: An out-of-bounds read can trigger a crash which leads to =
Denial of Service for an application.</span><br><br><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">The OpenSSL HTTP client API functions can be used =
directly by applications but they are also used by the OCSP client =
functions and CMP (Certificate Management Protocol) client implementation =
in OpenSSL. However the URLs used by these implementations are unlikely to =
be controlled by an attacker.</span><br><br><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;">In=
this vulnerable code the out of bounds read can only trigger a crash. =
Furthermore the vulnerability requires an attacker-controlled URL to be =
passed from an application to the OpenSSL function and the user has to have=
a "no_proxy" environment variable set. For the aforementioned reasons the =
issue was assessed as Low severity.</span><br><br><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">The vulnerable code was introduced in the following =
patch releases:</span><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">3.0.16, 3.1.8, 3.2.4, 3=
.3.3, 3.4.0 and 3.5.0.</span><br><br><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;">The FIPS =
modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by =
this</span><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">issue, as the HTTP =
client implementation is outside the OpenSSL FIPS module</span><br><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">boundary.</span><br><br><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;">OpenSSL 3.5, 3.4, 3.3, 3.2 and 3.0 are vulnerable to this =
issue.</span><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">OpenSSL 1.1.1 and 1.0.2=
are not affected by this issue.</span><br><br><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;">OpenSSL 3.5 users should upgrade to OpenSSL 3.5.4.=
</span><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">OpenSSL 3.4 users =
should upgrade to OpenSSL 3.4.3.</span><br><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;">OpenSSL 3.3 users should upgrade to OpenSSL 3.3.5.=
</span><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">OpenSSL 3.2 users =
should upgrade to OpenSSL 3.2.6.</span><br><span style=3D"font-family: =
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;">OpenSSL 3.0 users should upgrade to OpenSSL 3.0.18.=
</span><br><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">This issue was reported=
on 16th August 2025 by Stanislav Fort (Aisle Research).</span><br><span =
style=3D"font-family: Roboto, sans-serif;" data-mce-style=3D"font-family: =
Roboto, sans-serif;">The fix was developed by <em>Stanislav Fort</em> =
(Aisle Research).</span></p><h3><br><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;">General =
Advisory Notes</span></h3><p><br><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;">URL for =
this Security Advisory:</span><br><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;"><a =
href=3D"https://api.ourmailsender4.com/c/06c77c705dea4b89a92e5d5108733bff_5=
737516dfa5c9b9ca87c9c1550906984?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac93=
7f9123669df1b44e75c299c024d3&aid=3DXp2h" data-mce-href=3D"https://openssl-l=
ibrary.org/news/secadv/20250930.txt" style=3D"color: =
#000000;">https://openssl-library.org/news/secadv/20250930.=
txt</a></span><br><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">Note: the online =
version of the advisory may be updated with additional =
details </span><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">over time.=
</span><br><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">For details of OpenSSL =
severity classifications, please see:</span><br><span style=3D"font-family:=
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;"><a href=3D"https://api.ourmailsender4.com/c/199dedf95fa332c0ce=
e844e904882a24_d7b8e6e21b8b9538620c03e4dbf3d125?sid=3D19575671a4a85cb28ba15=
02bd99ea2ba_ac937f9123669df1b44e75c299c024d3&aid=3DXp2h" =
data-mce-href=3D"https://openssl-library.org/policies/general/security-poli=
cy/" style=3D"color: #000000;">https://openssl-library.=
org/policies/general/security-policy/</a></span></p></div></td></tr></table=
></td></tr></table><table align=3D"center" class=3D"" style=3D"max-width: =
100%; min-width: 100%; " width=3D"100%" cellPadding=3D"0" =
cellSpacing=3D"0"><tr><td align=3D"center" style=3D"padding-top: 0px; =
padding-left: 0px; padding-right: 0px; padding-bottom: 20px; =
background-color: transparent; " width=3D"100%" valign=3D"top"><table =
align=3D"center" style=3D"min-width: 100%; border-collapse: collapse; =
border-top-color: #f4f4f4; border-top-style: solid; border-top-width: 2px; =
mso-table-lspace: 0pt; mso-table-rspace: 0pt; -ms-text-size-adjust: 100%; =
-webkit-text-size-adjust: 100%; " width=3D"100%" cellPadding=3D"0" =
cellSpacing=3D"0"><tr><td style=3D"-ms-text-size-adjust: 100%; =
mso-line-height-rule: exactly; -webkit-text-size-adjust: 100%; =
"><span/></td></tr></table></td></tr></table><table align=3D"center" =
class=3D"" style=3D"max-width: 100%; min-width: 100%; " width=3D"100%" =
cellPadding=3D"0" cellSpacing=3D"0"><tr><td style=3D"padding-top: 0; =
padding-left: 0; padding-right: 0; padding-bottom: 0; " =
width=3D"100%"><table align=3D"center" style=3D"max-width: 100%; " =
width=3D"100%" cellPadding=3D"0" cellSpacing=3D"0"><tr><td =
style=3D"padding-top: 0px; border-width: 0; padding-left: 0px; =
padding-right: 0px; padding-bottom: 10px; background-color: transparent; " =
width=3D"100%"><div style=3D"color: #000000; position: relative; font-size:=
14px; textAlign: left; word-break: break-word; font-family: arial; =
font-weight: normal; mso-line-height-rule: exactly; line-height: =
normal;letter-spacing: normal; "><div style=3D"text-align: center;" =
data-mce-style=3D"text-align: center;"><a href=3D"https://api.=
ourmailsender4.com/c/ed313f659f9f9d042b06994f7b95df2c_5c0c1097dbc01252c5feb=
e8378f16441?sid=3D19575671a4a85cb28ba1502bd99ea2ba_ac937f9123669df1b44e75c2=
99c024d3&aid=3DXp2h" target=3D"_blank" rel=3D"noopener" =
data-mce-href=3D"https://openssl-corporation.org" style=3D"color: =
#000000;">OpenSSL Corporation</a>, Inc. 40 East Main Street, Newark, =
<br>New Castle County, 19711, USA</div></div></td></tr></table></td></tr></=
table><table align=3D"center" class=3D"" style=3D"max-width: 100%; =
min-width: 100%; " width=3D"100%" cellPadding=3D"0" =
cellSpacing=3D"0"><tr><td style=3D"padding-top: 0px; padding-left: 0px; =
padding-right: 0px; padding-bottom: 0px; " width=3D"100%"><table =
align=3D"center" style=3D"max-width: 100%; " width=3D"100%" =
cellPadding=3D"0" cellSpacing=3D"0"><tr><td style=3D"padding-top: 0px; =
padding-left: 0px; padding-right: 0px; padding-bottom: 10px; =
background-color: transparent; " width=3D"100%"><div style=3D"color: =
#000000; position: relative; font-size: 14px; textAlign: left; word-break: =
break-word; font-family: arial; font-weight: normal; mso-line-height-rule: =
exactly; line-height: normal;letter-spacing: normal; "><div =
style=3D"text-align: center;" data-mce-style=3D"text-align: center;"><span =
style=3D"background-color: transparent;" data-mce-style=3D"background-color=
: transparent;"><a href=3D"https://api.ourmailsender4.com/api/unsubscribe?=
key=3Dada15b98c21ecc52eeb8c79c44a35d9960abd2459970b0f7ead8e512a98c8a3743a1b=
dd4aeb1e8ca6313af990467ae7f_822ae69dcbb3ab2b2dd8941e08ae4c52" =
data-mce-href=3D"https://api.ourmailsender4.com/api/unsubscribe?=
key=3Dada15b98c21ecc52eeb8c79c44a35d9960abd2459970b0f7ead8e512a98c8a3743a1b=
dd4aeb1e8ca6313af990467ae7f_822ae69dcbb3ab2b2dd8941e08ae4c52" =
style=3D"color: #000000;">Unsubscribe</a> | <a =
href=3D"https://api.ourmailsender4.com/api/update?key=3Dada15b98c21ecc52eeb=
8c79c44a35d9960abd2459970b0f7ead8e512a98c8a3743a1bdd4aeb1e8ca6313af990467ae=
7f_822ae69dcbb3ab2b2dd8941e08ae4c52" data-mce-href=3D"https://api.=
ourmailsender4.com/api/update?key=3Dada15b98c21ecc52eeb8c79c44a35d9960abd24=
59970b0f7ead8e512a98c8a3743a1bdd4aeb1e8ca6313af990467ae7f_822ae69dcbb3ab2b2=
dd8941e08ae4c52" style=3D"color: #000000;">Update Profile</a> | <=
a href=3D"https://api.ourmailsender4.com/api/junk?key=3Dada15b98c21ecc52eeb=
8c79c44a35d9960abd2459970b0f7ead8e512a98c8a3743a1bdd4aeb1e8ca6313af990467ae=
7f_822ae69dcbb3ab2b2dd8941e08ae4c52" data-mce-href=3D"https://api.=
ourmailsender4.com/api/junk?key=3Dada15b98c21ecc52eeb8c79c44a35d9960abd2459=
970b0f7ead8e512a98c8a3743a1bdd4aeb1e8ca6313af990467ae7f_822ae69dcbb3ab2b2dd=
8941e08ae4c52" data-mce-selected=3D"inline-boundary" style=3D"color: =
#000000;">Report Junk</a></span></div></div></td></tr></table></td></tr></t=
able><table align=3D"center" class=3D"" style=3D"max-width: 100%; =
min-width: 100%; " width=3D"100%" cellPadding=3D"0" =
cellSpacing=3D"0"><tr><td style=3D"padding-top: 0; padding-left: 0; =
padding-right: 0; padding-bottom: 0; " width=3D"100%"><table =
align=3D"center" style=3D"max-width: 100%; " width=3D"100%" =
cellPadding=3D"0" cellSpacing=3D"0"><tr><td style=3D"padding-top: 0px; =
border-width: 0; padding-left: 0px; padding-right: 0px; padding-bottom: =
20px; background-color: transparent; " width=3D"100%"><div style=3D"color: =
#000000; position: relative; font-size: 14px; textAlign: left; word-break: =
break-word; font-family: arial; font-weight: normal; mso-line-height-rule: =
exactly; line-height: normal;letter-spacing: normal; "><div =
style=3D"text-align: center;"><a href=3D"https://api.ourmailsender4.=
com/templatePreview?key=3Dada15b98c21ecc52eeb8c79c44a35d9960abd2459970b0f7e=
ad8e512a98c8a3743a1bdd4aeb1e8ca6313af990467ae7f_822ae69dcbb3ab2b2dd8941e08a=
e4c52&html=3Dtrue" target=3D"_blank" rel=3D"noopener" style=3D"color: =
#000000;">View this email in your browser</a></div></div></td></tr></table>=
</td></tr></table></td></tr></table></td></tr></table></td></tr></table></t=
d></tr></table></body></html>
----_NmP-2da0fc991343e694-Part_1--