Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

OpenSSL: Update fixes critical security flaw in encryption software

published 11 months ago

Summary

A critical security issue was found in OpenSSL, a widely used encryption library. This issue can allow an attacker to intercept sensitive information, such as passwords and credit card numbers, if they can intercept encrypted data in transit. To stay secure, update OpenSSL to the latest version.

What to do

Update redhat openssl to version 1:3.5.1-4.el9_7.
Update redhat openssl-debuginfo to version 1:3.5.1-4.el9_7.
Update redhat openssl-debugsource to version 1:3.5.1-4.el9_7.
Update redhat openssl-devel to version 1:3.5.1-4.el9_7.
Update redhat openssl-libs to version 1:3.5.1-4.el9_7.
Update redhat openssl-libs-debuginfo to version 1:3.5.1-4.el9_7.
Update redhat openssl-perl to version 1:3.5.1-4.el9_7.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:9::appstream	redhat	openssl	< 1:3.5.1-4.el9_7 Fix: upgrade to 1:3.5.1-4.el9_7
Red Hat:enterprise_linux:9::appstream	redhat	openssl-debuginfo	< 1:3.5.1-4.el9_7 Fix: upgrade to 1:3.5.1-4.el9_7
Red Hat:enterprise_linux:9::appstream	redhat	openssl-debugsource	< 1:3.5.1-4.el9_7 Fix: upgrade to 1:3.5.1-4.el9_7
Red Hat:enterprise_linux:9::appstream	redhat	openssl-devel	< 1:3.5.1-4.el9_7 Fix: upgrade to 1:3.5.1-4.el9_7
Red Hat:enterprise_linux:9::appstream	redhat	openssl-libs	< 1:3.5.1-4.el9_7 Fix: upgrade to 1:3.5.1-4.el9_7
Red Hat:enterprise_linux:9::appstream	redhat	openssl-libs-debuginfo	< 1:3.5.1-4.el9_7 Fix: upgrade to 1:3.5.1-4.el9_7
Red Hat:enterprise_linux:9::appstream	redhat	openssl-perl	< 1:3.5.1-4.el9_7 Fix: upgrade to 1:3.5.1-4.el9_7
Red Hat:enterprise_linux:9::baseos	redhat	openssl	< 1:3.5.1-4.el9_7 Fix: upgrade to 1:3.5.1-4.el9_7
Red Hat:enterprise_linux:9::baseos	redhat	openssl-debuginfo	< 1:3.5.1-4.el9_7 Fix: upgrade to 1:3.5.1-4.el9_7
Red Hat:enterprise_linux:9::baseos	redhat	openssl-debugsource	< 1:3.5.1-4.el9_7 Fix: upgrade to 1:3.5.1-4.el9_7
Red Hat:enterprise_linux:9::baseos	redhat	openssl-devel	< 1:3.5.1-4.el9_7 Fix: upgrade to 1:3.5.1-4.el9_7
Red Hat:enterprise_linux:9::baseos	redhat	openssl-libs	< 1:3.5.1-4.el9_7 Fix: upgrade to 1:3.5.1-4.el9_7
Red Hat:enterprise_linux:9::baseos	redhat	openssl-libs-debuginfo	< 1:3.5.1-4.el9_7 Fix: upgrade to 1:3.5.1-4.el9_7
Red Hat:enterprise_linux:9::baseos	redhat	openssl-perl	< 1:3.5.1-4.el9_7 Fix: upgrade to 1:3.5.1-4.el9_7

Original advisory text

Red Hat Security Advisory: openssl security update

References

https://access.redhat.com/errata/RHSA-2025:21255 Vendor Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2396054 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21255.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-9230 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-9230 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-9230 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.6 Medium

Timeline

Published14 Nov 2025

Updated6 Mar 2026

First seen6 Mar 2026

Sources

RHSA-2025:21255 · OSV

Track software like this

Free during beta