FKIE_CVE-2025-9232

Vulnerability from fkie_nvd - Published: 2025-09-30 14:15 - Updated: 2025-11-04 22:16
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.
References
openssl-security@openssl.orghttps://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35
openssl-security@openssl.orghttps://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b
openssl-security@openssl.orghttps://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3
openssl-security@openssl.orghttps://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf
openssl-security@openssl.orghttps://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0
openssl-security@openssl.orghttps://openssl-library.org/news/secadv/20250930.txt
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/30/5
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the \u0027no_proxy\u0027 environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na \u0027no_proxy\u0027 environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary."
    },
    {
      "lang": "es",
      "value": "Resumen del problema: Una aplicaci\u00f3n que utiliza las funciones API del cliente HTTP de OpenSSL puede desencadenar una lectura fuera de l\u00edmites si la variable de entorno \u0027no_proxy\u0027 est\u00e1 configurada y la porci\u00f3n de host del componente de autoridad de la URL HTTP es una direcci\u00f3n IPv6.\n\nResumen del impacto: Una lectura fuera de l\u00edmites puede desencadenar un fallo que lleva a una denegaci\u00f3n de servicio para una aplicaci\u00f3n.\n\nLas funciones API del cliente HTTP de OpenSSL pueden ser utilizadas directamente por las aplicaciones, pero tambi\u00e9n son utilizadas por las funciones del cliente OCSP y la implementaci\u00f3n del cliente CMP (Protocolo de Gesti\u00f3n de Certificados) en OpenSSL. Sin embargo, es poco probable que las URL utilizadas por estas implementaciones sean controladas por un atacante.\n\nEn este c\u00f3digo vulnerable, la lectura fuera de l\u00edmites solo puede desencadenar un fallo. Adem\u00e1s, la vulnerabilidad requiere que una URL controlada por un atacante sea pasada de una aplicaci\u00f3n a la funci\u00f3n de OpenSSL y que el usuario tenga configurada una variable de entorno \u0027no_proxy\u0027. Por las razones antes mencionadas, el problema fue evaluado como de baja severidad.\n\nEl c\u00f3digo vulnerable fue introducido en las siguientes versiones de parche: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 y 3.5.0.\n\nLos m\u00f3dulos FIPS en 3.5, 3.4, 3.3, 3.2, 3.1 y 3.0 no se ven afectados por este problema, ya que la implementaci\u00f3n del cliente HTTP est\u00e1 fuera del l\u00edmite del m\u00f3dulo FIPS de OpenSSL."
    }
  ],
  "id": "CVE-2025-9232",
  "lastModified": "2025-11-04T22:16:45.630",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-09-30T14:15:41.313",
  "references": [
    {
      "source": "openssl-security@openssl.org",
      "url": "https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35"
    },
    {
      "source": "openssl-security@openssl.org",
      "url": "https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b"
    },
    {
      "source": "openssl-security@openssl.org",
      "url": "https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3"
    },
    {
      "source": "openssl-security@openssl.org",
      "url": "https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf"
    },
    {
      "source": "openssl-security@openssl.org",
      "url": "https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0"
    },
    {
      "source": "openssl-security@openssl.org",
      "url": "https://openssl-library.org/news/secadv/20250930.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2025/09/30/5"
    }
  ],
  "sourceIdentifier": "openssl-security@openssl.org",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "openssl-security@openssl.org",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.