update openssl to 3.5.5 to fix cve-2025-15467 #293
Conversation
Update OpenSSL from 3.4.3 to 3.5.5 to address CVE-2025-15467, a critical stack buffer overflow vulnerability in OpenSSL versions 3.0 through 3.6. The vulnerability affects CMS/PKCS#7 content processing with AEAD ciphers and can lead to denial-of-service or potentially remote code execution. Changes: - Update RESTY_OPENSSL_VERSION to 3.5.5 (patched version) - Update RESTY_OPENSSL_PATCH_VERSION to 3.5.4 (closest available OpenResty patch) - Affected flavors: alpine, bionic, focal, jammy, noble References: - CVE-2025-15467: https://nvd.nist.gov/vuln/detail/CVE-2025-15467 - OpenSSL 3.5.5 Release: https://github.com/openssl/openssl/releases/tag/openssl-3.5.5
the 3.5.4 patch doesn't apply cleanly to 3.5.5 and openresty works fine without it since the patches only add optional ssl session callback features for advanced lua integration
updated building.md to reflect new openssl version and added changelog entry for cve fix
|
Thanks for your concern to this. As noted in #291 , I won't accept skipping the patching, but I'm glad you are sharing a workaround for those who it might not matter. Hopefully it can be resolved soon. If you wanted to look at why the patches fail and submit a fix for that, I would accept a PR like that. We can include our own patches in this repo that are eventually upstreamed. |
created a fixed version of the openresty openssl patch that works with 3.5.5. the original 3.5.4 patch doesn't apply cleanly due to formatting changes in openssl 3.5.5 (changed from "# define" to "#define"). the fixed patch includes all necessary changes for ssl session lookup callbacks that enable lua-based session management in openresty. tested and verified working on alpine and ubuntu jammy.
|
hey, first time contributing here so let me know if i missed anything. i looked into why the 3.5.4 patch wasn't working with openssl 3.5.5. turns out openssl changed their formatting - they removed the space in "# define" and made it "#define". that's why all the hunks were failing. so i manually fixed the patch to work with 3.5.5 and added it to the repo in patches/openssl-3.5.5-sess_set_get_cb_yield.patch. tested it locally on my machine and both alpine and ubuntu jammy are building and running fine with openssl 3.5.5. the openresty ssl session stuff works too. hope this helps get the cve fixed. let me know if you need me to change anything. |
|
Thanks for diving into that! From first skim this is looking in good shape. If you want to add yourself to AUTHORS.md, feel free. I will review the patch deeper later today. But I suspect this will be rolled out tonight. |
|
Thanks! happy to help. let me know if you need anything else when you do the deeper review. |
|
Hope all is well. Just wanted to check in on this when you get a chance. Let me know if you need anything else from me! |
|
I have a reviewed and squashed commit rolling through on my fork. GitHub Action Runners were broken yesterday, continuing on today. Hopefully it all goes through today, but the full build takes many hours. |
|
Cool, thanks for this and let me know if I can help. |
2 participants
updates openssl from 3.4.3 to 3.5.5 to address cve-2025-15467 - stack buffer overflow in openssl 3.x
the vulnerability affects cms/pkcs7 content processing with aead ciphers and can lead to dos or rce. happens before authentication so no valid keys needed.
changes:
verified both the openssl 3.5.5 tarball and openresty 3.5.4 patch are available.
references:
https://nvd.nist.gov/vuln/detail/CVE-2025-15467
https://github.com/openssl/openssl/releases/tag/openssl-3.5.5