Bug 2430376 (CVE-2025-15467)

Summary:	CVE-2025-15467 openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	alaxkar, csutherl, cy.schubert, jclere, pjindal, plodge, security-response-team, szappis, vchlup
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in OpenSSL. A remote attacker can exploit a stack buffer overflow vulnerability by supplying a crafted Cryptographic Message Syntax (CMS) message with an oversized Initialization Vector (IV) when parsing AuthEnvelopedData structures that use Authenticated Encryption with Associated Data (AEAD) ciphers such as AES-GCM. This can lead to a crash, causing a Denial of Service (DoS), or potentially allow for remote code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2433376, 2433379, 2433380, 2433382, 2433383, 2433384, 2433386, 2433378, 2433381, 2433385
Bug Blocks:
Deadline:	2026-01-27

Description OSIDB Bzimport 2026-01-16 14:27:29 UTC

A stack buffer overflow may lead to a crash, causing Denial
of Service, or potentially remote code execution.

When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as
AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is
copied into a fixed-size stack buffer without verifying that its length fits
the destination. An attacker can supply a crafted CMS message with an
oversized IV, causing a stack-based out-of-bounds write before any
authentication or tag verification occurs.

Applications and services that parse untrusted CMS or PKCS#7 content using
AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable.
Because the overflow occurs prior to authentication, no valid key material
is required to trigger it. While exploitability to remote code execution
depends on platform and toolchain mitigations, the stack-based write
primitive represents a severe risk.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this
issue, as the CMS implementation is outside the OpenSSL FIPS module
boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.

OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.

OpenSSL 3.6 users should upgrade to OpenSSL 3.6.1.

OpenSSL 3.5 users should upgrade to OpenSSL 3.5.5.

OpenSSL 3.4 users should upgrade to OpenSSL 3.4.4.

OpenSSL 3.3 users should upgrade to OpenSSL 3.3.6.

OpenSSL 3.0 users should upgrade to OpenSSL 3.0.19.

Comment 3 errata-xmlrpc 2026-01-28 08:57:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:1472 https://access.redhat.com/errata/RHSA-2026:1472

Comment 4 errata-xmlrpc 2026-01-28 09:54:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:1473 https://access.redhat.com/errata/RHSA-2026:1473

Comment 5 errata-xmlrpc 2026-01-28 15:24:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:1496 https://access.redhat.com/errata/RHSA-2026:1496

Comment 6 errata-xmlrpc 2026-01-28 17:02:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:1503 https://access.redhat.com/errata/RHSA-2026:1503

Comment 7 errata-xmlrpc 2026-01-29 00:11:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:1519 https://access.redhat.com/errata/RHSA-2026:1519

Comment 8 errata-xmlrpc 2026-01-29 17:13:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:1594 https://access.redhat.com/errata/RHSA-2026:1594

Comment 9 errata-xmlrpc 2026-02-02 17:28:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:1733 https://access.redhat.com/errata/RHSA-2026:1733

Comment 10 errata-xmlrpc 2026-02-11 04:36:59 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.20

Via RHSA-2026:2077 https://access.redhat.com/errata/RHSA-2026:2077

Comment 11 errata-xmlrpc 2026-02-11 04:47:57 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.18

Via RHSA-2026:2072 https://access.redhat.com/errata/RHSA-2026:2072

Comment 12 errata-xmlrpc 2026-02-18 13:06:12 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.16

Via RHSA-2026:2659 https://access.redhat.com/errata/RHSA-2026:2659

Comment 13 errata-xmlrpc 2026-02-18 21:00:45 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.19

Via RHSA-2026:2633 https://access.redhat.com/errata/RHSA-2026:2633

Comment 14 errata-xmlrpc 2026-02-18 21:20:37 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.17

Via RHSA-2026:2671 https://access.redhat.com/errata/RHSA-2026:2671

Comment 15 errata-xmlrpc 2026-02-23 19:19:35 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Core Services 2.4.62.SP3

Via RHSA-2026:2995 https://access.redhat.com/errata/RHSA-2026:2995

Comment 18 errata-xmlrpc 2026-02-26 14:42:34 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2026:2974 https://access.redhat.com/errata/RHSA-2026:2974

Comment 19 errata-xmlrpc 2026-03-05 11:24:28 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2026:3415 https://access.redhat.com/errata/RHSA-2026:3415

Comment 20 errata-xmlrpc 2026-03-19 05:49:03 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.15

Via RHSA-2026:4419 https://access.redhat.com/errata/RHSA-2026:4419