Improper input validation in Oracle Communications Cloud Native Core Certificate Management - CVE-2025-27587

Vulnerability identifier: #VU117442

CSH Severity: Medium

CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-27587

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Configuration (OpenSSL) component in Oracle Communications Cloud Native Core Certificate Management. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.

Oracle Communications Cloud Native Core Certificate Management
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Basesystem Module
openSUSE Leap
libopenssl-3-devel-32bit
libopenssl3-64bit
libopenssl-3-fips-provider-64bit
libopenssl-3-fips-provider-64bit-debuginfo
libopenssl-3-devel-64bit
libopenssl3-64bit-debuginfo
openssl-3-doc
libopenssl-3-fips-provider-32bit-debuginfo
libopenssl-3-fips-provider-32bit
libopenssl3-32bit
libopenssl3
libopenssl3-32bit-debuginfo
libopenssl-3-fips-provider
libopenssl3-debuginfo
openssl-3-debugsource
libopenssl-3-devel
openssl-3-debuginfo
openssl-3
libopenssl-3-fips-provider-debuginfo

Install updates from vendor's website.

libopenssl-3-devel-32bit - update to 3.1.4-150600.5.27.1
libopenssl3-64bit - update to 3.1.4-150600.5.27.1
libopenssl-3-fips-provider-64bit - update to 3.1.4-150600.5.27.1
libopenssl-3-fips-provider-64bit-debuginfo - update to 3.1.4-150600.5.27.1
libopenssl-3-devel-64bit - update to 3.1.4-150600.5.27.1
libopenssl3-64bit-debuginfo - update to 3.1.4-150600.5.27.1
openssl-3-doc - update to 3.1.4-150600.5.27.1
libopenssl-3-fips-provider-32bit-debuginfo - update to 3.1.4-150600.5.27.1
libopenssl-3-fips-provider-32bit - update to 3.1.4-150600.5.27.1
libopenssl3-32bit - update to 3.1.4-150600.5.27.1
libopenssl3 - update to 3.1.4-150600.5.27.1
libopenssl3-32bit-debuginfo - update to 3.1.4-150600.5.27.1
libopenssl-3-fips-provider - update to 3.1.4-150600.5.27.1
libopenssl3-debuginfo - update to 3.1.4-150600.5.27.1
openssl-3-debugsource - update to 3.1.4-150600.5.27.1
libopenssl-3-devel - update to 3.1.4-150600.5.27.1
openssl-3-debuginfo - update to 3.1.4-150600.5.27.1
openssl-3 - update to 3.1.4-150600.5.27.1
libopenssl-3-fips-provider-debuginfo - update to 3.1.4-150600.5.27.1

• https://www.oracle.com/security-alerts/cpuoct2025.html

• Multiple vulnerabilities in Oracle Communications Cloud Native Core Certificate Management
• SUSE update for openssl-3