CVE-2025-69421
Fixed in a distro release EPSS <1%CVSS 7.5
Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files. The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before dereferencing it. When called from PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can be NULL, causing a crash. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. Exploiting this issue requires an attacker to provide a malformed PKCS#12 file to an application that processes it. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
Products: OpenSSL, Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux:10 | openssl | 1:3.5.1-7.el10_1.alma.1 |
| AlmaLinux:10 | openssl-devel | 1:3.5.1-7.el10_1.alma.1 |
| AlmaLinux:10 | openssl-libs | 1:3.5.1-7.el10_1.alma.1 |
| AlmaLinux:10 | openssl-perl | 1:3.5.1-7.el10_1.alma.1 |
| AlmaLinux:9 | openssl | 1:3.5.1-7.el9_7 |
| AlmaLinux:9 | openssl-devel | 1:3.5.1-7.el9_7 |
| AlmaLinux:9 | openssl-libs | 1:3.5.1-7.el9_7 |
| AlmaLinux:9 | openssl-perl | 1:3.5.1-7.el9_7 |
| Alpine:v3.17 | openssl | 3.0.19-r0 |
| Alpine:v3.20 | openssl | 3.3.6-r0 |
| Alpine:v3.21 | openssl | 3.3.6-r0 |
| Alpine:v3.22 | openssl | 3.5.5-r0 |
| Alpine:v3.23 | openssl | 3.5.5-r0 |
| Alpine:v3.24 | openssl | 3.5.5-r0 |
| Chainguard | libcrypto3-2.34 | 3.6.1-r0 |
| Chainguard | openssl | 3.6.1-r0 |
| Chainguard | openssl-provider-fips | 0 |
| Chainguard | openssl-provider-fips-3.1.2 | 0 |
| Chainguard | openssl-provider-fips-3.4.0 | 0 |
| Chainguard | openssl-provider-fips-3.6.0 | 0 |
| Debian:11 | openssl | 1.1.1w-0+deb11u5 |
| Debian:12 | openssl | 3.0.18-1~deb12u2 |
| Debian:13 | openssl | 3.5.4-1~deb13u2 |
| Debian:14 | openssl | 3.5.5-1 |
| Red Hat:enterprise_linux:10.1 | openssl | 1:3.5.1-7.el10_1 |
| Red Hat:enterprise_linux:10.1 | openssl-debuginfo | 1:3.5.1-7.el10_1 |
| Red Hat:enterprise_linux:10.1 | openssl-debugsource | 1:3.5.1-7.el10_1 |
| Red Hat:enterprise_linux:10.1 | openssl-devel | 1:3.5.1-7.el10_1 |
| Red Hat:enterprise_linux:10.1 | openssl-libs | 1:3.5.1-7.el10_1 |
| Red Hat:enterprise_linux:10.1 | openssl-libs-debuginfo | 1:3.5.1-7.el10_1 |
| Red Hat:enterprise_linux:10.1 | openssl-perl | 1:3.5.1-7.el10_1 |
| Red Hat:enterprise_linux:9 | openssl | 1:3.5.1-7.el9_7 |
| Red Hat:enterprise_linux:9 | openssl-debuginfo | 1:3.5.1-7.el9_7 |
| Red Hat:enterprise_linux:9 | openssl-debugsource | 1:3.5.1-7.el9_7 |
| Red Hat:enterprise_linux:9 | openssl-devel | 1:3.5.1-7.el9_7 |
| Red Hat:enterprise_linux:9 | openssl-libs | 1:3.5.1-7.el9_7 |
| Red Hat:enterprise_linux:9 | openssl-libs-debuginfo | 1:3.5.1-7.el9_7 |
| Red Hat:enterprise_linux:9 | openssl-perl | 1:3.5.1-7.el9_7 |
| Red Hat:hummingbird:1 | openssl | 0:3.5.6-0.1.hum1 |
| Red Hat:hummingbird:1 | openssl-config-fips | 0:3.5.6-0.1.hum1 |
| Red Hat:hummingbird:1 | openssl-devel | 0:3.5.6-0.1.hum1 |
| Red Hat:hummingbird:1 | openssl-devel-engine | 0:3.5.6-0.1.hum1 |
| Red Hat:hummingbird:1 | openssl-libs | 0:3.5.6-0.1.hum1 |
| Red Hat:hummingbird:1 | openssl-perl | 0:3.5.6-0.1.hum1 |
| Rocky Linux:10 | openssl | 1:3.5.1-7.el10_1 |
| Rocky Linux:9 | openssl | 1:3.5.1-7.el9_7 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | openssl-1_0_0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | openssl-1_1 | 1.1.1l-150400.7.87.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | openssl-3 | 3.0.8-150400.4.78.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | openssl-1_0_0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | openssl-1_1 | 1.1.1l-150400.7.87.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | openssl-3 | 3.0.8-150400.4.78.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | openssl-1_1 | 1.1.1l-150500.17.46.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | openssl-3 | 3.0.8-150500.5.57.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | openssl-1_1 | 1.1.1l-150500.17.46.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | openssl-3 | 3.0.8-150500.5.57.1 |
| SUSE:Linux Enterprise Micro 5.2 | openssl-1_1 | 1.1.1d-150200.11.106.1 |
| SUSE:Linux Enterprise Micro 5.3 | openssl-1_1 | 1.1.1l-150400.7.87.1 |
| SUSE:Linux Enterprise Micro 5.3 | openssl-3 | 3.0.8-150400.4.78.1 |
| SUSE:Linux Enterprise Micro 5.4 | openssl-1_1 | 1.1.1l-150400.7.87.1 |
| SUSE:Linux Enterprise Micro 5.4 | openssl-3 | 3.0.8-150400.4.78.1 |
| SUSE:Linux Enterprise Micro 5.5 | openssl-1_1 | 1.1.1l-150500.17.46.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | openssl-1_1 | 1.1.1w-150700.11.11.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | openssl-3 | 3.2.3-150700.5.24.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | openssl-1_1 | 1.1.1w-150700.11.11.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP7 | openssl-1_0_0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP7 | openssl-1_1 | 1.1.1w-150700.11.11.1 |
| SUSE:Linux Enterprise Server 11 SP4 LTSS EXTREME CORE | openssl1 | 1.0.1g-58.90.2 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | openssl-1_0_0 | 1.0.2p-3.103.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | openssl-1_1 | 1.1.1d-2.122.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | openssl-1_0_0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | openssl-1_1 | 1.1.1l-150400.7.87.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | openssl-3 | 3.0.8-150400.4.78.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | openssl-1_0_0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | openssl-1_1 | 1.1.1l-150500.17.46.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | openssl-3 | 3.0.8-150500.5.57.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | openssl-1_0_0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | openssl-1_1 | 1.1.1w-150600.5.21.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | openssl-3 | 3.1.4-150600.5.42.1 |
| SUSE:Linux Enterprise Server 16.0 | openssl-3 | 3.5.0-160000.5.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | openssl-1_0_0 | 1.0.2p-3.103.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | openssl-1_1 | 1.1.1d-2.122.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | openssl-1_0_0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | openssl-1_1 | 1.1.1l-150400.7.87.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | openssl-3 | 3.0.8-150400.4.78.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | openssl-1_0_0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | openssl-1_1 | 1.1.1l-150500.17.46.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | openssl-3 | 3.0.8-150500.5.57.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | openssl-1_0_0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | openssl-1_1 | 1.1.1w-150600.5.21.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | openssl-3 | 3.1.4-150600.5.42.1 |
| SUSE:Linux Enterprise Server for SAP applications 16.0 | openssl-3 | 3.5.0-160000.5.1 |
| SUSE:Linux Micro 6.0 | openssl-3 | 3.1.4-11.1 |
| SUSE:Linux Micro 6.1 | openssl-3 | 3.1.4-slfo.1.1_8.1 |
| SUSE:Linux Micro 6.2 | openssl-3 | 3.5.0-160000.5.1 |
| Ubuntu:22.04:LTS | openssl | 3.0.2-0ubuntu1.21 |
| Ubuntu:24.04:LTS | openssl | 3.0.13-0ubuntu3.7 |
| Ubuntu:25.10 | openssl | 3.5.3-1ubuntu3 |
| Ubuntu:26.04:LTS | openssl | 3.5.5-1ubuntu1 |
| Ubuntu:Pro:14.04:LTS | openssl | 1.0.1f-1ubuntu2.27+esm12 |
| Ubuntu:Pro:16.04:LTS | nodejs | no fix |
| Ubuntu:Pro:16.04:LTS | openssl | 1.0.2g-1ubuntu4.20+esm14 |
| Ubuntu:Pro:18.04:LTS | nodejs | no fix |
| Ubuntu:Pro:18.04:LTS | openssl | 1.1.1-1ubuntu2.1~18.04.23+esm7 |
| Ubuntu:Pro:18.04:LTS | openssl1.0 | 1.0.2n-1ubuntu5.13+esm3 |
| Ubuntu:Pro:20.04:LTS | openssl | 1.1.1f-1ubuntu2.24+esm2 |
| Ubuntu:Pro:22.04:LTS | nodejs | no fix |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | openssl | no fix |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | openssl-fips | no fix |
| Ubuntu:Pro:FIPS-updates:16.04:LTS | openssl | 1.0.2g-1ubuntu4.fips.4.20.14 |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | openssl | 1.1.1-1ubuntu2.fips.2.1~18.04.23.7 |
| Ubuntu:Pro:FIPS-updates:20.04:LTS | openssl | 1.1.1f-1ubuntu2.fips.24.2 |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | openssl | 3.0.2-0ubuntu1.21+Fips1 |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | openssl-fips | no fix |
| Ubuntu:Pro:FIPS-updates:24.04:LTS | openssl-fips | 3.0.13-0ubuntu3.12+Fips1 |
| Ubuntu:Pro:FIPS:16.04:LTS | openssl | no fix |
| Ubuntu:Pro:FIPS:18.04:LTS | openssl | no fix |
| Ubuntu:Pro:FIPS:20.04:LTS | openssl | no fix |
| Wolfi | openssl | 3.6.1-r0 |
| openSUSE:Leap 15.6 | openssl-1_0_0 | 1.0.2p-150000.3.102.1 |
| openSUSE:Leap 15.6 | openssl-1_1 | 1.1.1w-150600.5.21.1 |
| openSUSE:Leap 15.6 | openssl-3 | 3.1.4-150600.5.42.1 |
| openSUSE:Leap 16.0 | openssl-3 | 3.5.0-160000.5.1 |
| openSUSE:Tumbleweed | openssl-3 | 3.5.3-2.1 |