CVE-2025-69420

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-69420
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69420.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-69420
Downstream
ALPINE (1)
ALSA (2)
AZL (5)
BELL (1)
CGA (20)
CLEANSTART (2)
CLSA (2)
DEBIAN (1)
ECHO (1)
JLSEC (1)
MGASA (1)
MINI (3)
OESA (15)
openSUSE (2)
RHSA (3)
RLSA (2)
ROOT (1)
SUSE (17)
UBUNTU (1)
Related
ALSA (2)
openSUSE (2)
SUSE (17)
Published
2026-01-27T16:01:25Z
Modified
2026-11-11T13:19:31Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Missing ASN1_TYPE validation in TS_RESP_verify_response() function
Details

Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file.

Impact summary: An application calling TS_RESP_verify_response() with a malformed TimeStamp Response can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service.

The functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2() access the signing cert attribute value without validating its type. When the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash.

Exploiting this vulnerability requires an attacker to provide a malformed TimeStamp Response to an application that verifies timestamp responses. The TimeStamp protocol (RFC 3161) is not widely used and the impact of the exploit is just a Denial of Service. For these reasons the issue was assessed as Low severity.

The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the TimeStamp Response implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.

OpenSSL 1.0.2 is not affected by this issue.

Database specific 
{
    "cna_assigner": "openssl",
    "cwe_ids": [
        "CWE-754"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69420.json"
}
References

Affected packages

Git / github.com/kzalewski/openssl-1.1.1

Affected ranges

Type
GIT
Repo
https://github.com/kzalewski/openssl-1.1.1
Events
Introduced
9ad69b994ae7c73ba06d9f75efd2625102de814c
Fixed
9ad69b994ae7c73ba06d9f75efd2625102de814c
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.1.1"
                },
                {
                    "fixed": "1.1.1ze"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}
Type
GIT
Repo
https://github.com/openssl/openssl
Events
Introduced
e04bd3433fd84e1861bf258ea37928d9845e6a86
Fixed
e04bd3433fd84e1861bf258ea37928d9845e6a86
Introduced
89cd17a031e022211684eb7eb41190cf1910f9fa
Fixed
a22063cd69a077cc68bb4c10e9f351f75899b194
Introduced
4cb31128b5790819dfeea2739fbde265f71a10a2
Fixed
4601ff25acd6c2fe58a8bfe241e6c470e27b8074
Introduced
98acb6b02839c609ef5b837794e08d906d965335
Fixed
565bdcc41bbf89fcbaf962636469332689f0c9fd
Introduced
636dfadc70ce26f2473870570bfd9ec352806b1d
Fixed
67b5686b4419b4cb8caa502711c41815f5279751
Introduced
7b371d80d959ec9ab4139d09d78e83c090de9779
Fixed
c9a9e5b10105ad850b6e4d1122c645c67767c341
Fixed
27c7012c91cc986a598d7540f3079dfde2416eb9
Fixed
4e254b48ad93cc092be3dd62d97015f33f73133a
Fixed
564fd9c73787f25693bf9e75faf7bf6bb1305d4e
Fixed
5eb0770ffcf11b785cf374ff3c19196245e54f1b
Fixed
a99349ebfc519999edc50620abe24d599b9eb085
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.1.1"
                },
                {
                    "fixed": "1.1.1ze"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.0.0"
                },
                {
                    "fixed": "3.0.19"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.3.0"
                },
                {
                    "fixed": "3.3.6"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.4.0"
                },
                {
                    "fixed": "3.4.4"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.5.0"
                },
                {
                    "fixed": "3.5.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.6.0"
                },
                {
                    "fixed": "3.6.1"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "27c7012c91cc986a598d7540f3079dfde2416eb9"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "4e254b48ad93cc092be3dd62d97015f33f73133a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "564fd9c73787f25693bf9e75faf7bf6bb1305d4e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "5eb0770ffcf11b785cf374ff3c19196245e54f1b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "a99349ebfc519999edc50620abe24d599b9eb085"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

3.*
3.0-POST-CLANG-FORMAT-WEBKIT
3.0-PRE-CLANG-FORMAT-WEBKIT
3.3-POST-CLANG-FORMAT-WEBKIT
3.3-PRE-CLANG-FORMAT-WEBKIT
3.4-POST-CLANG-FORMAT-WEBKIT
3.4-PRE-CLANG-FORMAT-WEBKIT
3.5-POST-CLANG-FORMAT-WEBKIT
3.5-PRE-CLANG-FORMAT-WEBKIT
3.6-POST-CLANG-FORMAT-WEBKIT
3.6-PRE-CLANG-FORMAT-WEBKIT
openssl-3.*
openssl-3.0.0
openssl-3.0.1
openssl-3.0.10
openssl-3.0.11
openssl-3.0.12
openssl-3.0.13
openssl-3.0.14
openssl-3.0.15
openssl-3.0.16
openssl-3.0.17
openssl-3.0.18
openssl-3.0.2
openssl-3.0.3
openssl-3.0.4
openssl-3.0.5
openssl-3.0.6
openssl-3.0.7
openssl-3.0.8
openssl-3.0.9
openssl-3.3.0
openssl-3.3.1
openssl-3.3.2
openssl-3.3.3
openssl-3.3.4
openssl-3.3.5
openssl-3.4.0
openssl-3.4.1
openssl-3.4.2
openssl-3.4.3
openssl-3.5.0
openssl-3.5.1
openssl-3.5.2
openssl-3.5.3
openssl-3.5.4
openssl-3.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69420.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "42797208737688127763066522181332281160",
            "length": 507
        },
        "id": "CVE-2025-69420-17161750",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
        "target": {
            "file": "test/ec_internal_test.c",
            "function": "setup_tests"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "201888226879888819651681590595522968327",
                "55997044344403922093111884346552998173",
                "4978588019549099552408349898016254549",
                "176160634447836910802018056675653643760",
                "129627066050902738130928955327242745830",
                "329755338793737530275862164871587223473",
                "38252633268232289492692485526011033030",
                "55868587811027651874806109339695070292"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-69420-1f47a4bf",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e",
        "target": {
            "file": "crypto/ts/ts_rsp_verify.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "230361427007416664995616424352791763469",
                "68454496777232705137616949383570055801",
                "174227485603324825134703660955423564225",
                "306374039697804480350160125378658725435",
                "223787537721903344733141597182001711142",
                "305852724676774806958748002571762917320",
                "61902118637910596077004663207701223681",
                "278724473247779637198513168995006009135",
                "150804929727413209120953746872414715465",
                "166774358343717215765245239236385866693",
                "116293081894868411264108492273509366961",
                "326496170417124709669304286305887789679",
                "278306348133167756990680493182074324125",
                "189649085256091224929149730235838635518",
                "82945606976757935725900546138315651129",
                "136187505923069729147869676886657763243",
                "233447734599456461300796481665382809870",
                "116930820689846462220149337293161556595",
                "153181275943870954612030432229689150702",
                "65985025876624501603393736976041980125"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-69420-3349f255",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
        "target": {
            "file": "crypto/bn/bn_gf2m.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "201888226879888819651681590595522968327",
                "55997044344403922093111884346552998173",
                "4978588019549099552408349898016254549",
                "176160634447836910802018056675653643760",
                "129627066050902738130928955327242745830",
                "329755338793737530275862164871587223473",
                "38252633268232289492692485526011033030",
                "55868587811027651874806109339695070292"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-69420-4114d774",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9",
        "target": {
            "file": "crypto/ts/ts_rsp_verify.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "278237621881370507895367925432790678808",
            "length": 302
        },
        "id": "CVE-2025-69420-4d9da00d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e",
        "target": {
            "file": "crypto/ts/ts_rsp_verify.c",
            "function": "ossl_ess_get_signing_cert"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "30673062630639656303483208802482655434",
            "length": 494
        },
        "id": "CVE-2025-69420-4f7f516c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
        "target": {
            "file": "crypto/bn/bn_gf2m.c",
            "function": "BN_GF2m_poly2arr"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "201888226879888819651681590595522968327",
                "55997044344403922093111884346552998173",
                "4978588019549099552408349898016254549",
                "176160634447836910802018056675653643760",
                "129627066050902738130928955327242745830",
                "329755338793737530275862164871587223473",
                "38252633268232289492692485526011033030",
                "55868587811027651874806109339695070292"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-69420-5b510dc0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085",
        "target": {
            "file": "crypto/ts/ts_rsp_verify.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "281745662143339069291279319188916354096",
            "length": 304
        },
        "id": "CVE-2025-69420-81eb58fe",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9",
        "target": {
            "file": "crypto/ts/ts_rsp_verify.c",
            "function": "ossl_ess_get_signing_cert_v2"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "278237621881370507895367925432790678808",
            "length": 302
        },
        "id": "CVE-2025-69420-9a34b20b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a",
        "target": {
            "file": "crypto/ts/ts_rsp_verify.c",
            "function": "ossl_ess_get_signing_cert"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "278237621881370507895367925432790678808",
            "length": 302
        },
        "id": "CVE-2025-69420-bb58f1b7",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085",
        "target": {
            "file": "crypto/ts/ts_rsp_verify.c",
            "function": "ossl_ess_get_signing_cert"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "28170854778703993674264004058177114599",
                "73132526844288570625317440636111911761",
                "177405411499435185068645597737938634778",
                "224809958623850711330610094965797758930",
                "295554444428855106393106961197201359586"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-69420-c377fa22",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/e04bd3433fd84e1861bf258ea37928d9845e6a86",
        "target": {
            "file": "include/openssl/opensslv.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "281745662143339069291279319188916354096",
            "length": 304
        },
        "id": "CVE-2025-69420-c98920e1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b",
        "target": {
            "file": "crypto/ts/ts_rsp_verify.c",
            "function": "ossl_ess_get_signing_cert_v2"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "201888226879888819651681590595522968327",
                "55997044344403922093111884346552998173",
                "4978588019549099552408349898016254549",
                "176160634447836910802018056675653643760",
                "129627066050902738130928955327242745830",
                "329755338793737530275862164871587223473",
                "38252633268232289492692485526011033030",
                "55868587811027651874806109339695070292"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-69420-d9f79c91",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b",
        "target": {
            "file": "crypto/ts/ts_rsp_verify.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "201888226879888819651681590595522968327",
                "55997044344403922093111884346552998173",
                "4978588019549099552408349898016254549",
                "176160634447836910802018056675653643760",
                "129627066050902738130928955327242745830",
                "329755338793737530275862164871587223473",
                "38252633268232289492692485526011033030",
                "55868587811027651874806109339695070292"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-69420-e03b5a47",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a",
        "target": {
            "file": "crypto/ts/ts_rsp_verify.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "281745662143339069291279319188916354096",
            "length": 304
        },
        "id": "CVE-2025-69420-e61af670",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a",
        "target": {
            "file": "crypto/ts/ts_rsp_verify.c",
            "function": "ossl_ess_get_signing_cert_v2"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "278237621881370507895367925432790678808",
            "length": 302
        },
        "id": "CVE-2025-69420-e805be8c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9",
        "target": {
            "file": "crypto/ts/ts_rsp_verify.c",
            "function": "ossl_ess_get_signing_cert"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "281745662143339069291279319188916354096",
            "length": 304
        },
        "id": "CVE-2025-69420-e9b0c2d3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085",
        "target": {
            "file": "crypto/ts/ts_rsp_verify.c",
            "function": "ossl_ess_get_signing_cert_v2"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "278237621881370507895367925432790678808",
            "length": 302
        },
        "id": "CVE-2025-69420-e9cddd65",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b",
        "target": {
            "file": "crypto/ts/ts_rsp_verify.c",
            "function": "ossl_ess_get_signing_cert"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "281745662143339069291279319188916354096",
            "length": 304
        },
        "id": "CVE-2025-69420-eda6ad8a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e",
        "target": {
            "file": "crypto/ts/ts_rsp_verify.c",
            "function": "ossl_ess_get_signing_cert_v2"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "202560716467995180801900703314012126638",
                "231076714992210239911677876085986544653",
                "119476550149019858610160764241585512883",
                "237713134421560846878241190267682686452",
                "291912177671523663250360670212314966717",
                "148718397703357758449784276736258891876",
                "8308956487359903771982894414540058331",
                "219665286569007368979236427780197060159"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-69420-f19f6747",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
        "target": {
            "file": "test/ec_internal_test.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "215474658839038190857768659117172798903",
                "224789752300883698945153787266757617261",
                "56494159630746388130037307952134413004",
                "164370382436795402003615230331141913984",
                "149153318460680570484795927015804201404"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-69420-fa870959",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
        "target": {
            "file": "include/openssl/opensslv.h"
        }
    }
]
vanir_signatures_modified 
"2026-11-11T13:19:31Z"