Skip to content

CVE-2025-9232 Out-of-bounds read in HTTP client no_proxy handling

MediumCVSS 5.9 EPSS 2.4%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

Issue summary: An application using the OpenSSL HTTP client API functions may
trigger an out-of-bounds read if the 'no_proxy' environment variable is set and
the host portion of the authority component of the HTTP URL is an IPv6 address.

Impact summary: An out-of-bounds read can trigger a crash which leads to
Denial of Service for an application.

The OpenSSL HTTP client API functions can be used directly by applications
but they are also used by the OCSP client functions and CMP (Certificate
Management Protocol) client implementation in OpenSSL. However the URLs used
by these implementations are unlikely to be controlled by an attacker.

In this vulnerable code the out of bounds read can only trigger a crash.
Furthermore the vulnerability requires an attacker-controlled URL to be
passed from an application to the OpenSSL function and the user has to have
a 'no_proxy' environment variable set. For the aforementioned reasons the
issue was assessed as Low severity.

The vulnerable code was introduced in the following patch releases:
3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.

The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
issue, as the HTTP client implementation is outside the OpenSSL FIPS module
boundary.

Affected products

ProductAffected versionsFixed in
OpenSSL(Azure Linux:3.0) < 3.3.5-1 3.3.5-1
azure linux rust(Azure Linux:3.0) All versions No fix listed
azure linux qemu(Azure Linux:3.0) All versions No fix listed
debian/openssl(Debian:12) < 3.0.17-1~deb12u3 3.0.17-1~deb12u3
debian/openssl(Debian:12) = 3.0.10-1 No fix listed
debian/openssl(Debian:12) = 3.0.10-1~deb12u1 No fix listed
debian/openssl(Debian:12) = 3.0.11-1 No fix listed
debian/openssl(Debian:12) = 3.0.11-1~deb12u1 No fix listed
debian/openssl(Debian:12) = 3.0.11-1~deb12u2 No fix listed
debian/openssl(Debian:12) = 3.0.12-1 No fix listed
debian/openssl(Debian:12) = 3.0.12-2 No fix listed
debian/openssl(Debian:12) = 3.0.13-1~deb12u1 No fix listed
debian/openssl(Debian:12) = 3.0.13-1~deb12u2 No fix listed
debian/openssl(Debian:12) = 3.0.14-1~deb12u1 No fix listed
debian/openssl(Debian:12) = 3.0.14-1~deb12u2 No fix listed
debian/openssl(Debian:12) = 3.0.15-1~deb12u1 No fix listed
debian/openssl(Debian:12) = 3.0.16-1~deb12u1 No fix listed
debian/openssl(Debian:12) = 3.0.17-1~deb12u1 No fix listed
debian/openssl(Debian:12) = 3.0.17-1~deb12u2 No fix listed
debian/openssl(Debian:12) = 3.0.9-1 No fix listed
debian/openssl(Debian:13) < 3.5.1-1+deb13u1 3.5.1-1+deb13u1
debian/openssl(Debian:13) = 3.5.1-1 No fix listed
debian/openssl(Debian:14) < 3.5.4-1 3.5.4-1
debian/openssl(Debian:14) = 3.5.1-1 No fix listed
debian/openssl(Debian:14) = 3.5.2-1 No fix listed
Show 54 more
ProductAffected versionsFixed in
debian/openssl(Debian:14) = 3.5.3-1 No fix listed
debian/openssl(Debian:14) = 3.5.4-1~deb13u1 No fix listed
debian/openssl(Debian:14) = 3.5.4-1~deb13u2 No fix listed
OpenSSL >= 3.5.0, < 3.5.4 3.5.4
OpenSSL >= 3.4.0, < 3.4.3 3.4.3
OpenSSL >= 3.3.3, < 3.3.5 3.3.5
OpenSSL >= 3.2.4, < 3.2.6 3.2.6
OpenSSL >= 3.0.16, < 3.0.18 3.0.18
Siemens RUGGEDCOM RST2428P < V3.3 V3.3
Siemens RUGGEDCOM RST2428P < V4.0 V4.0
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family < V3.3 V3.3
Siemens SCALANCE XCH328 < V3.3 V3.3
Siemens SCALANCE XCM324 < V3.3 V3.3
Siemens SCALANCE XCM328 < V3.3 V3.3
Siemens SCALANCE XCM332 < V3.3 V3.3
Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) < V3.3 V3.3
Siemens SCALANCE XRM334 (230 V AC, 12xFO) < V3.3 V3.3
Siemens SCALANCE XRM334 (230 V AC, 8xFO) < V3.3 V3.3
Siemens SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) < V3.3 V3.3
Siemens SCALANCE XRM334 (24 V DC, 12xFO) < V3.3 V3.3
Siemens SCALANCE XRM334 (24 V DC, 8xFO) < V3.3 V3.3
Siemens SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) < V3.3 V3.3
Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) < V3.3 V3.3
Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) < V3.3 V3.3
Siemens SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) < V3.3 V3.3
Siemens SIDIS Prime < V4.0.800 V4.0.800
Siemens SIDIS Secured SmartPlug < V7.26.0310 V7.26.0310
Siemens SIMATIC CN 4100 < V5.0 V5.0
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP >= V3.1.5 No fix listed
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP >= V3.1.5 No fix listed
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP >= V3.1.5 No fix listed
ubuntu/nodejs(Ubuntu:22.04) All versions No fix listed
alpine/openssl(Alpine:v3.17) >= 1.0.2, < 3.0.19-r0 3.0.19-r0
alpine/openssl(Alpine:v3.19) >= 1.0.2, < 3.1.8-r1 3.1.8-r1
alpine/openssl(Alpine:v3.20) >= 1.0.2, < 3.3.5-r0 3.3.5-r0
alpine/openssl(Alpine:v3.21) >= 1.0.2, < 3.3.5-r0 3.3.5-r0
alpine/openssl(Alpine:v3.22) >= 1.0.2, < 3.5.4-r0 3.5.4-r0
alpine/openssl(Alpine:v3.23) >= 1.0.2, < 3.5.4-r0 3.5.4-r0
alpine/openssl(Alpine:v3.24) >= 1.0.2, < 3.5.4-r0 3.5.4-r0
ubuntu/edk2(Ubuntu:26.04) < 2025.02-8ubuntu3 2025.02-8ubuntu3
ubuntu/openssl(Ubuntu:26.04) < 3.5.3-1ubuntu2 3.5.3-1ubuntu2
OpenSSL >= 1.0.2, < 1.0.2zm 1.0.2zm
OpenSSL >= 1.1.1, < 1.1.1zd 1.1.1zd
OpenSSL >= 3.0.0, < 3.0.18 3.0.18
OpenSSL >= 3.2.0, < 3.2.6 3.2.6
OpenSSL >= 3.3.0, < 3.3.5 3.3.5
Siemens simatic cn 4100 firmware < 5.0 5.0
Siemens simatic s7-1500 cpu 1518-4 pndp mfp firmware = 3.1.5 No fix listed
Siemens simatic s7-1500 cpu 1518f-4 pndp mfp firmware = 3.1.5 No fix listed
Siemens siplus s7-1500 cpu 1518-4 pndp mfp firmware = 3.1.5 No fix listed
Siemens sinec os < 3.3 3.3
Siemens ruggedcom rst2428p firmware < 4.0 4.0
Siemens SIDIS Prime < 4.0.800 4.0.800
Siemens sidis secured smartplug firmware < 7.26.0310 7.26.0310

References