CVE-2025-15467 — Issue summary: Parsing CMS AuthEnvelopedData or...

发布于：2小时前📖 5分钟👁️ 1 次阅读

CVE-2025-15467 漏洞深度分析

漏洞概述

CVE 编号： CVE-2025-15467
CVSS 评分： 8.8（HIGH）
CVSS 向量： CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE 分类： CWE-787,CWE-120
漏洞状态： Modified
发布时间： 2026-01-27T16:16:14.257
最后更新： 2026-07-14T13:17:18.567

漏洞描述

Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with
maliciously crafted AEAD parameters can trigger a stack buffer overflow.

Impact summary: A stack buffer overflow may lead to a crash, causing Denial
of Service, or potentially remote code execution.

When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as
AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is
copied into a fixed-size stack buffer without verifying that its length fits
the destination. An attacker can supply a crafted CMS message with an
oversized IV, causing a stack-based out-of-bounds write before any
authentication or tag verification occurs.

Applications and services that parse untrusted CMS or PKCS#7 content using
AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.
Because the overflow occurs prior to authentication, no valid key material
is required to trigger it. While exploitability to remote code execution
depends on platform and toolchain mitigations, the stack-based write
primitive represents a severe risk.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this
issue, as the CMS implementation is outside the OpenSSL FIPS module
boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.

OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.

影响分析

此漏洞的具体影响取决于实际利用场景。"

修复建议

及时关注厂商发布的安全更新和补丁
升级受影响组件到最新版本
如无法立即升级，参考厂商提供的临时缓解措施
加强网络访问控制和监控

参考链接

💬 评论