Skip to content
Fencer Intel
critical 9.8

CVE-2025-9230 in the critical feed json

Out-of-bounds read & write in RFC 3211 KEK Unwrap

published last yr. modified 2h ago also EUVD-2025-31729 , JLSEC-2026-266

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write.

Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code.

Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy.

The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.

Patch / fix

  • julia OpenSSL_jll 3.0.20+0, 3.5.4+0
  • julia Openresty_jll 1.29.203+0
  • OpenSSL OpenSSL 1.0.2zm, 1.1.1zd, 3.0.18, 3.2.6, 3.3.5, 3.4.3, 3.5.4
  • Siemens RUGGEDCOM RST2428P V3.3, V4.0
  • Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family V3.3
  • Siemens SCALANCE XCH328 V3.3
  • Siemens SCALANCE XCM324 V3.3
  • Siemens SCALANCE XCM328 V3.3
  • Siemens SCALANCE XCM332 V3.3
  • Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) V3.3
  • Siemens SCALANCE XRM334 (230 V AC, 12xFO) V3.3
  • Siemens SCALANCE XRM334 (230 V AC, 8xFO) V3.3
  • Siemens SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) V3.3
  • Siemens SCALANCE XRM334 (24 V DC, 12xFO) V3.3
  • Siemens SCALANCE XRM334 (24 V DC, 8xFO) V3.3
  • Siemens SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) V3.3
  • Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) V3.3
  • Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) V3.3
  • Siemens SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) V3.3
  • Siemens SIDIS Prime V4.0.800
  • Siemens SIDIS Secured SmartPlug V7.26.0310
  • Siemens SIMATIC CN 4100 V5.0
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem V1.1.1
  • openssl Debian 12 3.0.17-1~deb12u3
  • openssl Debian 13 3.5.1-1+deb13u1
  • openssl Debian 14 3.5.4-1

debian advisories DEBIAN-CVE-2025-9230

  • openssl Ubuntu 22.04 LTS 3.0.2-0ubuntu1.20
  • openssl Ubuntu 24.04 LTS 3.0.13-0ubuntu3.6
  • openssl Ubuntu 26.04 LTS, Ubuntu 25.10 3.5.3-1ubuntu2
  • openssl Ubuntu Pro 14.04 LTS 1.0.1f-1ubuntu2.27+esm11
  • openssl Ubuntu Pro 16.04 LTS 1.0.2g-1ubuntu4.20+esm13
  • openssl Ubuntu Pro FIPS-updates 16.04 LTS 1.0.2g-1ubuntu4.fips.4.20.13
  • openssl Ubuntu Pro 18.04 LTS 1.1.1-1ubuntu2.1~18.04.23+esm6
  • openssl Ubuntu Pro FIPS-updates 18.04 LTS 1.1.1-1ubuntu2.fips.2.1~18.04.23.6

ubuntu advisories UBUNTU-CVE-2025-9230

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cjson satellite capsule 6.19, satellite 6.19 1.7.18-2.el9sat
  • foreman satellite utils 6.19, satellite capsule 6.19, satellite 6.19 3.18.0.3-3.el9sat
  • katello satellite capsule 6.19, satellite 6.19 4.20.0-1.el9sat
  • libcomps satellite maintenance 6.19, satellite capsule 6.19, satellite 6.19 0.1.23-1.el9pc
  • candlepin satellite 6.19 4.7.4-1.el9sat
  • libsodium satellite capsule 6.19, satellite 6.19 1.0.17-3.el9sat
  • mosquitto satellite capsule 6.19, satellite 6.19 2.0.19-1.el9sat
  • satellite satellite utils 6.19, satellite capsule 6.19, satellite 6.19 6.19.0-1.el9sat

red hat advisories RHBA-2026:14131RHSA-2026:65132RHSA-2026:50263RHSA-2026:50222RHSA-2026:50223RHSA-2026:36721

  • openssl-3-livepatches SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 0.3-160000.1.1
  • openssl-3 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.5.0-160000.4.1
  • openssl-1_0_0 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +10 more 1.0.2p-150000.3.97.1
  • openssl-3-livepatches Linux Micro 6.1 0.2-slfo.1.1_1.1
  • openssl-3 Linux Micro 6.1 3.1.4-slfo.1.1_7.1
  • openssl-3 Linux Micro 6.0 3.1.4-10.1
  • openssl-1_1 SLE Module for Legacy 15 SP7, SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 1.1.1w-150700.11.6.1
  • openssl-3 SLE Module for Basesystem 15 SP7 3.2.3-150700.5.21.1

suse advisories SUSE-SU-2026:20542-1SUSE-SU-2026:20607-1SUSE-SU-2025:21213-1SUSE-SU-2025:21224-1SUSE-SU-2025:4126-1SUSE-SU-2025:3917-1

  • openssl-3 openSUSE Tumbleweed 3.5.3-2.1
  • openssl-3 openSUSE Leap 16.0 3.5.0-160000.4.1
  • regclient openSUSE Tumbleweed 0.10.0-1.1

opensuse advisories openSUSE-SU-2026:10237-1openSUSE-SU-2025:20164-1openSUSE-SU-2025:15723-1

  • edk2-ovmf AlmaLinux 8 20220126gitbb1bba3d77-13.el8_10.10
  • edk2-aarch64 AlmaLinux 8 20220126gitbb1bba3d77-13.el8_10.10
  • edk2-ovmf AlmaLinux 9 20241117-4.el9_7.3
  • edk2-tools AlmaLinux 9 20241117-4.el9_7.3
  • edk2-aarch64 AlmaLinux 9 20241117-4.el9_7.3
  • openssl AlmaLinux 8 1:1.1.1k-14.el8_10
  • openssl-libs AlmaLinux 8 1:1.1.1k-14.el8_10
  • openssl-perl AlmaLinux 8 1:1.1.1k-14.el8_10

almalinux advisories ALSA-2026:36721ALSA-2026:2776ALSA-2026:0337ALSA-2025:21248ALSA-2025:21255

  • edk2 Rocky Linux 8 20220126gitbb1bba3d77-13.el8_10.10
  • edk2 Rocky Linux 9 20241117-4.el9_7.3
  • openssl Rocky Linux 8 1:1.1.1k-14.el8_10
  • openssl Rocky Linux 10 1:3.5.1-4.el10_1
  • openssl Rocky Linux 9 1:3.5.1-4.el9_7

rocky linux advisories RLSA-2026:36721RLSA-2026:2776RLSA-2026:0337RLSA-2025:21248RLSA-2025:21255

  • openssl Alpine 3.17 3.0.19-r0
  • openssl Alpine 3.19 3.1.8-r1
  • openssl Alpine 3.21, Alpine 3.20 3.3.5-r0
  • openssl Alpine 3.24, Alpine 3.23, Alpine 3.22 3.5.4-r0
  • libressl Alpine 3.24, Alpine 3.23, Alpine 3.22 4.1.1-r0

alpine advisories ALPINE-CVE-2025-9230

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl Azure Linux 3.0 3.3.5-1
  • openssl CBL-Mariner 2.0 1.1.1k-37
  • edk2 Azure Linux 3.0 20240524git3e722403cd16-10

azure linux advisories AZL-67980AZL-67997AZL-68082

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2025-9230 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-9230 updated cvss 5.6

openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap

  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/work-rhel9, multicloud-operators-foundation, multicluster-engine/placement-rhel8, multicluster-engine-registration-container, multicluster-engine/registration-operator-rhel8, multicluster-engine/hypershift-addon-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/klusterlet-addon-controller-rhel8, acm-multicluster-engine-operator-container, rhacm2/clusterlifecycle-state-metrics-rhel8, acm-cluster-manager-addon-manager-controller-container
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 6 openssl, openssl-perl
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Satellite 6 puppet-agent Red Hat Satellite Client puppet-agent
    affected: workaround, no fix available
  • Red Hat Cost Management 4 costmanagement 4.3.0-1763050722
    fixed: vendor fix RHSA-2025:22428
  • Red Hat AI Inference Server 3.2 rhaiis 1772160593, rhaiis 1772160625, rhaiis 3.2.2-1764871796, rhaiis 3.2.2-1765379049, rhaiis 3.2.2-1765379088, rhaiis 3.2.5-1765361180, +4 more
    fixed: vendor fix RHSA-2025:23080
  • Red Hat Ceph Storage 7 rhceph
    fixed: vendor fix RHSA-2025:22529
  • Red Hat Ceph Storage 8 rhceph, rhceph 1769512383
    fixed: vendor fix RHSA-2025:22548
  • Red Hat CodeReady Linux Builder EUS (v.9.4) edk2-ovmf 20231122-6.el9_4.10, edk2-tools 20231122-6.el9_4.10, edk2-aarch64 20231122-6.el9_4.10
    fixed: vendor fix RHSA-2026:3164
show 29 more
  • Red Hat CodeReady Linux Builder EUS (v.9.6) edk2-ovmf 20241117-2.el9_6.2, edk2-tools 20241117-2.el9_6.2, edk2-aarch64 20241117-2.el9_6.2
    fixed: vendor fix RHSA-2026:2771
  • Red Hat Discovery 2 discovery 2.4.0-1763596485, discovery 2.4.0-1763656152
    fixed: vendor fix RHSA-2025:21994
  • Red Hat Enterprise Linux AppStream (v. 8) edk2 20220126gitbb1bba3d77-13.el8_10.10, edk2-ovmf 20220126gitbb1bba3d77-13.el8_10.10, edk2-aarch64 20220126gitbb1bba3d77-13.el8_10.10
    fixed: vendor fix RHSA-2026:36721
  • Red Hat Enterprise Linux AppStream (v. 9) edk2 20241117-4.el9_7.3, openssl-perl 3.5.1-4.el9_7, edk2-ovmf 20241117-4.el9_7.3, edk2-aarch64 20241117-4.el9_7.3
    fixed: vendor fix RHSA-2026:2776
  • Red Hat Enterprise Linux AppStream (v. 10) edk2 20250822-4.el10, edk2-ovmf 20250822-4.el10, openssl-perl 3.5.1-4.el10_1, edk2-aarch64 20250822-4.el10
    fixed: vendor fix RHSA-2025:21248
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) edk2 20220126gitbb1bba3d77-4.el8_8.8, edk2-ovmf 20220126gitbb1bba3d77-4.el8_8.8
    fixed: vendor fix RHSA-2026:35846
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) openssl-perl 3.0.1-46.el9_0.6
    fixed: vendor fix RHSA-2026:1349
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) openssl-perl 3.0.7-18.el9_2.2
    fixed: vendor fix RHSA-2026:0794
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) edk2 20241117-2.el10_0.2, edk2-ovmf 20241117-2.el10_0.2, openssl-perl 3.2.2-16.el10_0.5, edk2-aarch64 20241117-2.el10_0.2
    fixed: vendor fix RHSA-2026:65132
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) edk2 20231122-6.el9_4.10, edk2-ovmf 20231122-6.el9_4.10, openssl-perl 3.0.7-29.el9_4.1, edk2-aarch64 20231122-6.el9_4.10
    fixed: vendor fix RHSA-2026:3164
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) edk2 20241117-2.el9_6.2, edk2-ovmf 20241117-2.el9_6.2, openssl-perl 3.2.2-7.el9_6.1, edk2-aarch64 20241117-2.el9_6.2
    fixed: vendor fix RHSA-2026:2771
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) edk2 20220126gitbb1bba3d77-4.el8_8.8, edk2-ovmf 20220126gitbb1bba3d77-4.el8_8.8
    fixed: vendor fix RHSA-2026:35846
  • Red Hat Enterprise Linux BaseOS (v. 8) openssl 1.1.1k-14.el8_10, openssl-libs 1.1.1k-14.el8_10, openssl-perl 1.1.1k-14.el8_10
    fixed: vendor fix RHSA-2026:0337
  • Red Hat Enterprise Linux BaseOS (v. 9) openssl 3.5.1-4.el9_7, openssl-libs 3.5.1-4.el9_7
    fixed: vendor fix RHSA-2025:21255
  • Red Hat Enterprise Linux BaseOS (v. 10) openssl 3.5.1-4.el10_1, openssl-libs 3.5.1-4.el10_1
    fixed: vendor fix RHSA-2025:21248
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) openssl 1.1.1c-21.el8_2.1, openssl-libs 1.1.1c-21.el8_2.1, openssl-perl 1.1.1c-21.el8_2.1
    fixed: vendor fix RHSA-2026:0887
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) openssl 1.1.1g-18.el8_4.1, openssl-libs 1.1.1g-18.el8_4.1, openssl-perl 1.1.1g-18.el8_4.1
    fixed: vendor fix RHSA-2026:1475
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) openssl 1.1.1k-14.el8_6.1, openssl-libs 1.1.1k-14.el8_6.1, openssl-perl 1.1.1k-14.el8_6.1 Red Hat Enterprise Linux BaseOS E4S (v.8.6) openssl 1.1.1k-14.el8_6.1, openssl-libs 1.1.1k-14.el8_6.1, openssl-perl 1.1.1k-14.el8_6.1
    fixed: vendor fix RHSA-2026:0714
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) openssl 1.1.1k-14.el8_8.1, openssl-libs 1.1.1k-14.el8_8.1, openssl-perl 1.1.1k-14.el8_8.1
    fixed: vendor fix RHSA-2026:0602
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) openssl 3.0.1-46.el9_0.6, openssl-libs 3.0.1-46.el9_0.6, openssl-fips-provider 3.0.7-1.el9_0.1, openssl-fips-provider-so 3.0.7-1.el9_0.1
    fixed: vendor fix RHSA-2026:1349
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) openssl 3.0.7-18.el9_2.2, openssl-libs 3.0.7-18.el9_2.2, openssl-fips-provider 3.0.7-1.el9_2.1, openssl-fips-provider-so 3.0.7-1.el9_2.1
    fixed: vendor fix RHSA-2026:0794
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) openssl 3.2.2-16.el10_0.5, openssl-libs 3.2.2-16.el10_0.5
    fixed: vendor fix RHSA-2025:22794
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) openssl 3.0.7-29.el9_4.1, openssl-libs 3.0.7-29.el9_4.1
    fixed: vendor fix RHSA-2025:21562
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) openssl 3.2.2-7.el9_6.1, openssl-libs 3.2.2-7.el9_6.1
    fixed: vendor fix RHSA-2025:21174
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) openssl 1.1.1g-18.el8_4.1, openssl-libs 1.1.1g-18.el8_4.1, openssl-perl 1.1.1g-18.el8_4.1
    fixed: vendor fix RHSA-2026:1475
  • Red Hat Enterprise Linux BaseOS TUS (v.8.6) openssl 1.1.1k-14.el8_6.1, openssl-libs 1.1.1k-14.el8_6.1, openssl-perl 1.1.1k-14.el8_6.1
    fixed: vendor fix RHSA-2026:0714
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) openssl 1.1.1k-14.el8_8.1, openssl-libs 1.1.1k-14.el8_8.1, openssl-perl 1.1.1k-14.el8_8.1
    fixed: vendor fix RHSA-2026:0602
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) edk2-ovmf 20241117-4.el9_7.3, edk2-tools 20241117-4.el9_7.3, edk2-aarch64 20241117-4.el9_7.3
    fixed: vendor fix RHSA-2026:2776
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) edk2-ovmf 20250822-4.el10, edk2-tools 20250822-4.el10, edk2-aarch64 20250822-4.el10
    fixed: vendor fix RHSA-2026:18320

21 more fixed, 19 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-202-04 updated cvss 7.5

Siemens SIDIS Secured SmartPlug

  • Siemens SIDIS Secured SmartPlug < 7.26.0310
    affected: fixed in V7.26.0310

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-102-01 updated cvss 7.5

Siemens SIMATIC S7-1500 TM MFP

  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-162-05 updated cvss 7.5

Siemens SIMATIC S7-1500 CPU family

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.5
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-26-071-03 updated cvss 5.6

Siemens SIDIS Prime

  • Siemens SIDIS Prime < 4.0.800
    affected: fixed in V4.0.800

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-26-043-06 updated cvss 5.6

Siemens SINEC OS

  • Siemens RUGGEDCOM RST2428P (6GK6242-6PA00) < 3.3
    affected: fixed in V3.3 support.industry.siemens.com
  • Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family < 3.3
    affected: fixed in V3.3
  • Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) < 3.3 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) < 3.3 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) < 3.3 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) < 3.3 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) < 3.3 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) < 3.3
    +8 more products
    Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) < 3.3 Siemens SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3) < 3.3 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) < 3.3 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) < 3.3 Siemens SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3) < 3.3 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) < 3.3 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) < 3.3 Siemens SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3) < 3.3
    affected: fixed in V3.3 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
3d ago

Exploit prediction

1.64% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
julia OpenSSL_jll
<3.0.20+0
>=3.5.0+0, <3.5.4+0
3.0.20+0
3.5.4+0
julia Openresty_jll
<1.29.203+0
1.29.203+0

Affected products

  • OpenSSL OpenSSL
  • Siemens RUGGEDCOM RST2428P
  • Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family
  • Siemens SCALANCE XCH328
  • Siemens SCALANCE XCM324
  • Siemens SCALANCE XCM328
  • Siemens SCALANCE XCM332
  • Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC)
  • Siemens SCALANCE XRM334 (230 V AC, 12xFO)
  • Siemens SCALANCE XRM334 (230 V AC, 8xFO)
  • Siemens SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)
  • Siemens SCALANCE XRM334 (24 V DC, 12xFO)
  • Siemens SCALANCE XRM334 (24 V DC, 8xFO)
  • Siemens SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)
  • Siemens SCALANCE XRM334 (2x230 V AC, 12xFO)
  • Siemens SCALANCE XRM334 (2x230 V AC, 8xFO)
  • Siemens SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)
  • Siemens SIDIS Prime
  • Siemens SIDIS Secured SmartPlug
  • Siemens SIMATIC CN 4100
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.