1. Ubuntu Security Notices
  2. USN-7980-1

USN-7980-1: OpenSSL vulnerabilities

Publication date

27 January 2026

Overview

Several security issues were fixed in OpenSSL.

Releases

Packages

  • openssl - Secure Socket Layer (SSL) cryptographic library and tools

Details

Stanislav Fort, Petr Šimeček, and Hamza discovered that OpenSSL
incorrectly validated PBMAC1 parameters when doing PKCS#12 MAC
verification. An attacker could possibly use this issue to cause OpenSSL to
crash, resulting in a denial of service. This issue only affected Ubuntu
25.10. (CVE-2025-11187)

Stanislav Fort discovered that OpenSSL incorrectly parsed CMS
AuthEnvelopedData messages. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service. (CVE-2025-15467)

Stanislav Fort discovered that OpenSSL incorrectly handled memory in the
SSL_CIPHER_find() function. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service. This issue only
affected Ubuntu 25.10. (CVE-2025-15468)

Stanislav Fort discovered that the OpenSSL...

Stanislav Fort, Petr Šimeček, and Hamza discovered that OpenSSL
incorrectly validated PBMAC1 parameters when doing PKCS#12 MAC
verification. An attacker could possibly use this issue to cause OpenSSL to
crash, resulting in a denial of service. This issue only affected Ubuntu
25.10. (CVE-2025-11187)

Stanislav Fort discovered that OpenSSL incorrectly parsed CMS
AuthEnvelopedData messages. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service. (CVE-2025-15467)

Stanislav Fort discovered that OpenSSL incorrectly handled memory in the
SSL_CIPHER_find() function. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service. This issue only
affected Ubuntu 25.10. (CVE-2025-15468)

Stanislav Fort discovered that the OpenSSL "openssl dgst" command line
tool incorrectly truncated data to 16MB. An attacker could posibly use this
issue to hide unauthenticated data beyond the 16MB limit. This issue only
affected Ubuntu 25.10. (CVE-2025-15469)

Tomas Dulka and Stanislav Fort discovered that OpenSSL incorrectly handled
memory with TLS 1.3 connections using certificate compression. An attacker
could possibly use this issue to consume resources, leading to a denial of
service. This issue only affected Ubuntu 25.10. (CVE-2025-66199)

Petr Simecek and Stanislav Fort discovered that OpenSSL incorrectly handled
memory when writing large data into a BIO chain. An attacker could possibly
use this issue to consume resources, leading to a denial of service.
(CVE-2025-68160)

Stanislav Fort discovered that the OpenSSL OCB API could incorrectly leave
final partial blocks unencrypted and unauthenticated. An attacker could
possibly use this issue to read or tamper with the affected final bytes.
(CVE-2025-69418)

Stanislav Fort discovered that OpenSSL incorrectly handled the
PKCS12_get_friendlyname() utf-8 conversion. An attacker could possibly use
this issue to cause OpenSSL to crash, resulting in a denial of service.
(CVE-2025-69419)

Luigino Camastra discovered that OpenSSL incorrectly handled ASN1_TYPE
validation in the TS_RESP_verify_response() function. An attacker could
possibly use this issue to cause OpenSSL to crash, resulting in a denial of
service. (CVE-2025-69420)

Luigino Camastra discovered that OpenSSL incorrectly handled memory in the
PKCS12_item_decrypt_d2i_ex function. An attacker could possibly use this
issue to cause OpenSSL to crash, resulting in a denial of service.
(CVE-2025-69421)

Luigino Camastra discovered that OpenSSL incorrectly handled ASN1_TYPE
validation in PKCS#12 parsing. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service. (CVE-2026-22795)

Luigino Camastra discovered that OpenSSL incorrectly handled ASN1_TYPE
validation in the PKCS7_digest_from_attributes() function. An attacker
could possibly use this issue to cause OpenSSL to crash, resulting in a
denial of service. (CVE-2026-22796)

Update instructions

After a standard system update you need to reboot your computer to make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
25.10 questing libssl3t64 –  3.5.3-1ubuntu3
openssl –  3.5.3-1ubuntu3
24.04 LTS noble libssl3t64 –  3.0.13-0ubuntu3.7
openssl –  3.0.13-0ubuntu3.7
22.04 LTS jammy libssl3 –  3.0.2-0ubuntu1.21
openssl –  3.0.2-0ubuntu1.21

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›