CVE-2025-9230 (MEDIUM): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2025-9230	MEDIUM	openssl-fips-provider-latest	1:3.2.2-1.amzn2023.0.1	1:3.2.2-1.amzn2023.0.2	2025-09-30T14:15:41.05Z	2025-10-15T10:18:16.564586789Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/provided:latest	public.ecr.aws/lambda/provided@sha256:6b81435c6d98deca6af6944d4d0e8e103de05bd36d5c961f6564aa63086488d9
public.ecr.aws/lambda/provided:al2023	public.ecr.aws/lambda/provided@sha256:6b81435c6d98deca6af6944d4d0e8e103de05bd36d5c961f6564aa63086488d9
public.ecr.aws/lambda/python:latest	public.ecr.aws/lambda/python@sha256:ac4766a9047fed7306ed92aedc567c4b5114cdfee591d3d5e3f0cabd89f0acc6
public.ecr.aws/lambda/python:3.14-preview	public.ecr.aws/lambda/python@sha256:99c93902649f9e1fbc9fae5e2547162e2ae6e60801a33fbc6e36400c77ebb6a7
public.ecr.aws/lambda/python:3.13	public.ecr.aws/lambda/python@sha256:ac4766a9047fed7306ed92aedc567c4b5114cdfee591d3d5e3f0cabd89f0acc6
public.ecr.aws/lambda/python:3.12	public.ecr.aws/lambda/python@sha256:f2a3e490eb0574b71416f25f12c8a7bde97cede3f544dbed83565d9bf985b748
public.ecr.aws/lambda/nodejs:latest	public.ecr.aws/lambda/nodejs@sha256:45d6a4f6ec167384036d5351effe99fd39662de0f8ea184026ca9722099ff17a
public.ecr.aws/lambda/nodejs:24-preview	public.ecr.aws/lambda/nodejs@sha256:163ba86d7db72dac7883166e86868c952ebda895c3a79effa1043495c55bbce1
public.ecr.aws/lambda/nodejs:22	public.ecr.aws/lambda/nodejs@sha256:45d6a4f6ec167384036d5351effe99fd39662de0f8ea184026ca9722099ff17a
public.ecr.aws/lambda/nodejs:20	public.ecr.aws/lambda/nodejs@sha256:e583d07d62ee667f665dbe7de4c7ed09cba09899ba3c6024ef39f281b5dd5b2c
public.ecr.aws/lambda/java:latest	public.ecr.aws/lambda/java@sha256:c59964cf0f6a2d437727c2c82993c96b7e6de29703a969a05235853dad225558
public.ecr.aws/lambda/java:21	public.ecr.aws/lambda/java@sha256:c59964cf0f6a2d437727c2c82993c96b7e6de29703a969a05235853dad225558
public.ecr.aws/lambda/dotnet:latest	public.ecr.aws/lambda/dotnet@sha256:2f5f8cefa06decf77f044d2e2547a3796d32e36d1074e9af342cca3f431db761
public.ecr.aws/lambda/dotnet:10-preview	public.ecr.aws/lambda/dotnet@sha256:42082beb8d59e791623981f894ecfb9286413178fd2541ccb8c85488b66fac28
public.ecr.aws/lambda/dotnet:9	public.ecr.aws/lambda/dotnet@sha256:2f5f8cefa06decf77f044d2e2547a3796d32e36d1074e9af342cca3f431db761
public.ecr.aws/lambda/dotnet:8	public.ecr.aws/lambda/dotnet@sha256:df95ced9d1b4e777fd23379b2cc9ca5f50df5fd7f915c5a79c1c124a05e24ab0
public.ecr.aws/lambda/ruby:latest	public.ecr.aws/lambda/ruby@sha256:8ce43bc4e5c0a7047d81a99d2f2ccc23d6ad96127d7baaf50cb2036a896a7b38
public.ecr.aws/lambda/ruby:3.4	public.ecr.aws/lambda/ruby@sha256:8ce43bc4e5c0a7047d81a99d2f2ccc23d6ad96127d7baaf50cb2036a896a7b38
public.ecr.aws/lambda/ruby:3.3	public.ecr.aws/lambda/ruby@sha256:a4ad78cc251fbb3c9abe9a77ab4653280721272025f478bb3796f67c7267fc87

---

Description

Issue summary: An application trying to decrypt CMS messages encrypted using
password based encryption can trigger an out-of-bounds read and write.

Impact summary: This out-of-bounds read may trigger a crash which leads to
Denial of Service for an application. The out-of-bounds write can cause
a memory corruption which can have various consequences including
a Denial of Service or Execution of attacker-supplied code.

Although the consequences of a successful exploit of this vulnerability
could be severe, the probability that the attacker would be able to
perform it is low. Besides, password based (PWRI) encryption support in CMS
messages is very rarely used. For that reason the issue was assessed as
Moderate severity according to our Security Policy.

The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
issue, as the CMS implementation is outside the OpenSSL FIPS module
boundary.

---

Remediation Steps

• Update the affected package openssl-fips-provider-latest from version 1:3.2.2-1.amzn2023.0.1 to 1:3.2.2-1.amzn2023.0.2.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.