openkjdk/jdk:21-distroless openssl CVE-2025-15467

[Dekeyras]

Hi all,

In our container image scanning using trivy we have found a CRITICAL and several HIGH severity openssl vulnerabilities from mcr.microsoft.com/openjdk/jdk:21-distroless latest image sha256:1d97b36d499d2f8166d08cc2591a92b8c72f826ff098474d8a5ec964121b1eeb (6th Feb 2026).

{
          "VulnerabilityID": "CVE-2025-15467",
          "PkgName": "openssl",
          "PkgIdentifier": {
            "PURL": "pkg:rpm/azurelinux/openssl@3.3.5-1.azl3?arch=x86_64\u0026distro=azurelinux-3.0",
            "UID": "8ac33b94f51c1e38"
          },
          "InstalledVersion": "3.3.5-1.azl3",
          "FixedVersion": "3.3.5-2.azl3",
          "Status": "fixed",
          "Layer": {
            "DiffID": "sha256:26308a8ea57586d10288a37d589afd2b8693b145df276ad1959a2a0736db07c7"
          },
          "SeveritySource": "azure",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-15467",
          "DataSource": {
            "ID": "azure",
            "Name": "Azure Linux Vulnerability Data",
            "URL": "https://github.com/microsoft/AzureLinuxVulnerabilityData"
          },
          "Title": "openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing",
          "Description": "Issue summary: Parsing CMS AuthEnvelopedData message with maliciously\ncrafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-787"
          ],
          "VendorSeverity": {
            "alma": 3,
            "amazon": 3,
            "azure": 4,
            "oracle-oval": 3,
            "photon": 4,
            "redhat": 3,
            "rocky": 3,
            "ubuntu": 2
          },
          "CVSS": {
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            }
          },
          "References": [
            "http://www.openwall.com/lists/oss-security/2026/01/27/10",
            "https://access.redhat.com/errata/RHSA-2026:1472",
            "https://access.redhat.com/security/cve/CVE-2025-15467",
            "https://bugzilla.redhat.com/2430375",
            "https://bugzilla.redhat.com/2430376",
            "https://bugzilla.redhat.com/2430377",
            "https://bugzilla.redhat.com/2430378",
            "https://bugzilla.redhat.com/2430379",
            "https://bugzilla.redhat.com/2430380",
            "https://bugzilla.redhat.com/2430381",
            "https://bugzilla.redhat.com/2430386",
            "https://bugzilla.redhat.com/2430387",
            "https://bugzilla.redhat.com/2430388",
            "https://bugzilla.redhat.com/2430389",
            "https://bugzilla.redhat.com/2430390",
            "https://bugzilla.redhat.com/show_bug.cgi?id=2430375",
            "https://bugzilla.redhat.com/show_bug.cgi?id=2430376",
            "https://bugzilla.redhat.com/show_bug.cgi?id=2430377",
            "https://bugzilla.redhat.com/show_bug.cgi?id=2430378",
            "https://bugzilla.redhat.com/show_bug.cgi?id=2430379",
            "https://bugzilla.redhat.com/show_bug.cgi?id=2430380",
            "https://bugzilla.redhat.com/show_bug.cgi?id=2430381",
            "https://bugzilla.redhat.com/show_bug.cgi?id=2430386",
            "https://bugzilla.redhat.com/show_bug.cgi?id=2430387",
            "https://bugzilla.redhat.com/show_bug.cgi?id=2430388",
            "https://bugzilla.redhat.com/show_bug.cgi?id=2430389",
            "https://bugzilla.redhat.com/show_bug.cgi?id=2430390",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796",
            "https://errata.almalinux.org/10/ALSA-2026-1472.html",
            "https://errata.rockylinux.org/RLSA-2026:1473",
            "https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703",
            "https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9",
            "https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3",
            "https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e",
            "https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc",
            "https://linux.oracle.com/cve/CVE-2025-15467.html",
            "https://linux.oracle.com/errata/ELSA-2026-50081.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2025-15467",
            "https://openssl-library.org/news/secadv/20260127.txt",
            "https://ubuntu.com/security/notices/USN-7980-1",
            "https://www.cve.org/CVERecord?id=CVE-2025-15467"
          ],
          "PublishedDate": "2026-01-27T16:16:14.257Z",
          "LastModifiedDate": "2026-02-02T18:38:55.073Z"
        }

Is there a planned upgrade to the openssl library to a non-vulnerable version?

Thanks in advance

[joe-braley]

Hi @Dekeyras!

Thank you for bringing this to our attention and we do apologize for the delay in our response.

Our official build cadence may be found in our publicly available documentation at Container image rebuild schedule.

Since it has been sometime since the Issue was opened, could you kindly confirm that this Issue is still relevant or not with our latest images? When we build new images we should be obtaining the latest packages and, I believe, that the current version of openssl we have available is openssl-3.3.5-4.azl3.

Thanks!