[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-ALPINE-CVE-2025-69418":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":13,"downstream":16,"duplicates":17,"related":18,"reserved_at":9,"published_at":19,"modified_at":20,"state":9,"summary":21,"references_raw":23,"kevs":30,"epss":9,"epss_history":31,"metrics":32,"affected":39},"ALPINE-CVE-2025-69418","Issue summary: When using the low-level OCB API directly with AES-NI or\u003Cbr>other hardware-accelerated code paths, inputs whose length is not a multiple\u003Cbr>of 16 bytes can leave the final partial block unencrypted and unauthenticated.\u003Cbr>\u003Cbr>Impact summary: The trailing 1-15 bytes of a message may be exposed in\u003Cbr>cleartext on encryption and are not covered by the authentication tag,\u003Cbr>allowing an attacker to read or tamper with those bytes without detection.\u003Cbr>\u003Cbr>The low-level OCB encrypt and decrypt routines in the hardware-accelerated\u003Cbr>stream path process full 16-byte blocks but do not advance the input/output\u003Cbr>pointers. The subsequent tail-handling code then operates on the original\u003Cbr>base pointers, effectively reprocessing the beginning of the buffer while\u003Cbr>leaving the actual trailing bytes unprocessed. The authentication checksum\u003Cbr>also excludes the true tail bytes.\u003Cbr>\u003Cbr>However, typical OpenSSL consumers using EVP are not affected because the\u003Cbr>higher-level EVP and provider OCB implementations split inputs so that full\u003Cbr>blocks and trailing partial blocks are processed in separate calls, avoiding\u003Cbr>the problematic code path. Additionally, TLS does not use OCB ciphersuites.\u003Cbr>The vulnerability only affects applications that call the low-level\u003Cbr>CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with\u003Cbr>non-block-aligned lengths in a single call on hardware-accelerated builds.\u003Cbr>For these reasons the issue was assessed as Low severity.\u003Cbr>\u003Cbr>The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected\u003Cbr>by this issue, as OCB mode is not a FIPS-approved algorithm.\u003Cbr>\u003Cbr>OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\u003Cbr>\u003Cbr>OpenSSL 1.0.2 is not affected by this issue.",null,[],[],[],[14],{"_key":15},"CVE-2025-69418",[],[],[],"2026-01-27T16:16:33.253Z","2026-07-08T04:31:55.406338465Z",{"cisa_kev":22,"cisa_ransomware":22,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":9,"severity_score":9,"severity_version":9,"severity_source":9,"severity_vector":9,"severity_status":9},false,[24],{"url":25,"sources":26,"tags":28},"https://security.alpinelinux.org/vuln/CVE-2025-69418",[27],"osv_alpine",[29],"Advisory",[],[],[33],{"source":27,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":34,"cvss_v4_0":9},{"baseScore":35,"baseSeverity":9,"vectorString":36,"impactScore":37,"exploitabilityScore":38},4,"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",4.2,3.6,[40],{"ecosystem":41,"name":42,"vendor":43,"product":42,"cpe_part":9,"purl_type":44,"purl_namespace":43,"purl_name":42,"source":9,"versions":45},"Alpine Linux","openssl","alpine","apk",[46,52,55,56,59,60,61,65,67,68,70,71],{"version":47,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":50,"version_end_type":51,"fixed_in":9},"lt3_0_19_r0",true,"ecosystem","3.0.19-r0","excluding",{"version":53,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":54,"version_end_type":51,"fixed_in":9},"lt3_3_6_r0","3.3.6-r0",{"version":53,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":54,"version_end_type":51,"fixed_in":9},{"version":57,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":58,"version_end_type":51,"fixed_in":9},"lt3_5_5_r0","3.5.5-r0",{"version":57,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":58,"version_end_type":51,"fixed_in":9},{"version":57,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":58,"version_end_type":51,"fixed_in":9},{"version":62,"is_range":48,"range_type":49,"version_start":63,"version_start_type":64,"version_end":50,"version_end_type":51,"fixed_in":9},"gte1_1_1_lt3_0_19_r0","1.1.1","including",{"version":66,"is_range":48,"range_type":49,"version_start":63,"version_start_type":64,"version_end":54,"version_end_type":51,"fixed_in":9},"gte1_1_1_lt3_3_6_r0",{"version":66,"is_range":48,"range_type":49,"version_start":63,"version_start_type":64,"version_end":54,"version_end_type":51,"fixed_in":9},{"version":69,"is_range":48,"range_type":49,"version_start":63,"version_start_type":64,"version_end":58,"version_end_type":51,"fixed_in":9},"gte1_1_1_lt3_5_5_r0",{"version":69,"is_range":48,"range_type":49,"version_start":63,"version_start_type":64,"version_end":58,"version_end_type":51,"fixed_in":9},{"version":69,"is_range":48,"range_type":49,"version_start":63,"version_start_type":64,"version_end":58,"version_end_type":51,"fixed_in":9}]