Improper input validation in Oracle Communications Cloud Native Core Certificate Management - CVE-2025-27587

Vulnerability identifier: #VU117442

CSH Severity: Medium

CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-27587

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Configuration (OpenSSL) component in Oracle Communications Cloud Native Core Certificate Management. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.

Oracle Communications Cloud Native Core Certificate Management
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Basesystem Module
Web and Scripting Module
openSUSE Leap
libopenssl-3-fips-provider-debuginfo
libopenssl3
libopenssl3-64bit
libopenssl-3-fips-provider-64bit
libopenssl-3-fips-provider-64bit-debuginfo
libopenssl-3-devel-64bit
libopenssl3-64bit-debuginfo
openssl-3-doc
libopenssl-3-fips-provider-32bit-debuginfo
libopenssl-3-fips-provider-32bit
libopenssl-3-devel-32bit
libopenssl3-32bit-debuginfo
libopenssl-3-fips-provider
libopenssl3-debuginfo
openssl-3-debugsource
libopenssl-3-devel
openssl-3-debuginfo
openssl-3
libopenssl3-32bit
openssl
libopenssl-fips-provider
libopenssl-devel
nodejs24-docs
nodejs24-debuginfo
npm24
nodejs24
nodejs24-debugsource
nodejs24-devel

Install updates from vendor's website.

libopenssl-3-fips-provider-debuginfo - addressed in versions 3.1.4-150600.5.27.1, 3.5.0-150700.5.45.2
libopenssl3 - addressed in versions 3.1.4-150600.5.27.1, 3.5.0-150700.5.45.2
libopenssl3-64bit - update to 3.1.4-150600.5.27.1
libopenssl-3-fips-provider-64bit - update to 3.1.4-150600.5.27.1
libopenssl-3-fips-provider-64bit-debuginfo - update to 3.1.4-150600.5.27.1
libopenssl-3-devel-64bit - update to 3.1.4-150600.5.27.1
libopenssl3-64bit-debuginfo - update to 3.1.4-150600.5.27.1
openssl-3-doc - update to 3.1.4-150600.5.27.1
libopenssl-3-fips-provider-32bit-debuginfo - addressed in versions 3.1.4-150600.5.27.1, 3.5.0-150700.5.45.2
libopenssl-3-fips-provider-32bit - addressed in versions 3.1.4-150600.5.27.1, 3.5.0-150700.5.45.2
libopenssl-3-devel-32bit - update to 3.1.4-150600.5.27.1
libopenssl3-32bit-debuginfo - addressed in versions 3.1.4-150600.5.27.1, 3.5.0-150700.5.45.2
libopenssl-3-fips-provider - addressed in versions 3.1.4-150600.5.27.1, 3.5.0-150700.5.45.2
libopenssl3-debuginfo - addressed in versions 3.1.4-150600.5.27.1, 3.5.0-150700.5.45.2
openssl-3-debugsource - addressed in versions 3.1.4-150600.5.27.1, 3.5.0-150700.5.45.2
libopenssl-3-devel - addressed in versions 3.1.4-150600.5.27.1, 3.5.0-150700.5.45.2
openssl-3-debuginfo - addressed in versions 3.1.4-150600.5.27.1, 3.5.0-150700.5.45.2
openssl-3 - addressed in versions 3.1.4-150600.5.27.1, 3.5.0-150700.5.45.2
libopenssl3-32bit - addressed in versions 3.1.4-150600.5.27.1, 3.5.0-150700.5.45.2
openssl - update to 3.5.0-150700.3.4.1
libopenssl-fips-provider - update to 3.5.0-150700.3.4.1
libopenssl-devel - update to 3.5.0-150700.3.4.1
nodejs24-docs - update to 24.18.1-150700.15.18.1
nodejs24-debuginfo - update to 24.18.1-150700.15.18.1
npm24 - update to 24.18.1-150700.15.18.1
nodejs24 - update to 24.18.1-150700.15.18.1
nodejs24-debugsource - update to 24.18.1-150700.15.18.1
nodejs24-devel - update to 24.18.1-150700.15.18.1

• https://www.oracle.com/security-alerts/cpuoct2025.html

• Multiple vulnerabilities in Oracle Communications Cloud Native Core Certificate Management
• SUSE update for openssl-3
• SUSE update for openssl, openssl-3