Multiple vulnerabilities in OpenSSL
FreeBSD-SA-25:08.openssl · CVE-2025-9230, CVE-2025-9231, CVE-2025-9232
Our decision for FreeSense
FreeBSD corrected this on 2025-09-30, before the FreeBSD source pin of every FreeSense version.
- Advisory: corrected 2025-09-30
- FreeSense 1.0 pin: e004ff15f87e (2026-08-03)
- FreeSense 1.1 pin: a52c50b4b7c2 (2026-10-04)
- FreeSense 1.2 pin: a52c50b4b7c2 (2026-10-04)
By FreeSense version
| Version | Status | FreeBSD pin |
|---|---|---|
| FreeSense 1.01.0.7 · frozen, no further fixes | FixedFreeBSD pin of 2026-08-03 | 2026-08-03e004ff15 |
| FreeSense 1.11.1.9 | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
| FreeSense 1.21.2.0-DEVELOPMENT | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
Workaround
No workaround is available. Several of the issues have mitigating factors. Please see the Impact section for more details.
What FreeBSD says
* Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230) Affects: FreeBSD 15.x, 14.x, and 13.x An application trying to decrypt cryptographic message syntax (CMS) messages encrypted using password based encryption can trigger an out-of-bounds read and write. * Timing side-channel in SM2 algorithm on 64 bit ARM (CVE-2025-9231) Affects: FreeBSD 15.x only A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64-bit ARM platforms. * Out-of-bounds read in HTTP client no_proxy handling (CVE-2025-9232) Affects: FreeBSD 15.x and 14.x only An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the "no_proxy" environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address.
Impact
* Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230) Affects: FreeBSD 15.x, 14.x, and 13.x The out-of-bounds read may trigger a crash which leads to denial of service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a denial of service or execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that an attacker would be able to perform it is low. Password based (PWRI) encryption support in CMS messages is very rarely used. * Timing side-channel in SM2 algorithm on 64 bit ARM (CVE-2025-9231) Affects: FreeBSD 15.x only A timi
Excerpt from the FreeBSD advisory. Read the original for the full text and the fix.