CVE-2025-9231 (MEDIUM): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2025-9231	MEDIUM	openssl-fips-provider-latest	1:3.2.2-1.amzn2023.0.1	1:3.2.2-1.amzn2023.0.2	2025-09-30T14:15:41.19Z	2025-10-15T10:18:16.564586789Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/provided:latest	public.ecr.aws/lambda/provided@sha256:6b81435c6d98deca6af6944d4d0e8e103de05bd36d5c961f6564aa63086488d9
public.ecr.aws/lambda/provided:al2023	public.ecr.aws/lambda/provided@sha256:6b81435c6d98deca6af6944d4d0e8e103de05bd36d5c961f6564aa63086488d9
public.ecr.aws/lambda/python:latest	public.ecr.aws/lambda/python@sha256:ac4766a9047fed7306ed92aedc567c4b5114cdfee591d3d5e3f0cabd89f0acc6
public.ecr.aws/lambda/python:3.14-preview	public.ecr.aws/lambda/python@sha256:99c93902649f9e1fbc9fae5e2547162e2ae6e60801a33fbc6e36400c77ebb6a7
public.ecr.aws/lambda/python:3.13	public.ecr.aws/lambda/python@sha256:ac4766a9047fed7306ed92aedc567c4b5114cdfee591d3d5e3f0cabd89f0acc6
public.ecr.aws/lambda/python:3.12	public.ecr.aws/lambda/python@sha256:f2a3e490eb0574b71416f25f12c8a7bde97cede3f544dbed83565d9bf985b748
public.ecr.aws/lambda/nodejs:latest	public.ecr.aws/lambda/nodejs@sha256:45d6a4f6ec167384036d5351effe99fd39662de0f8ea184026ca9722099ff17a
public.ecr.aws/lambda/nodejs:24-preview	public.ecr.aws/lambda/nodejs@sha256:163ba86d7db72dac7883166e86868c952ebda895c3a79effa1043495c55bbce1
public.ecr.aws/lambda/nodejs:22	public.ecr.aws/lambda/nodejs@sha256:45d6a4f6ec167384036d5351effe99fd39662de0f8ea184026ca9722099ff17a
public.ecr.aws/lambda/nodejs:20	public.ecr.aws/lambda/nodejs@sha256:e583d07d62ee667f665dbe7de4c7ed09cba09899ba3c6024ef39f281b5dd5b2c
public.ecr.aws/lambda/java:latest	public.ecr.aws/lambda/java@sha256:c59964cf0f6a2d437727c2c82993c96b7e6de29703a969a05235853dad225558
public.ecr.aws/lambda/java:21	public.ecr.aws/lambda/java@sha256:c59964cf0f6a2d437727c2c82993c96b7e6de29703a969a05235853dad225558
public.ecr.aws/lambda/dotnet:latest	public.ecr.aws/lambda/dotnet@sha256:2f5f8cefa06decf77f044d2e2547a3796d32e36d1074e9af342cca3f431db761
public.ecr.aws/lambda/dotnet:10-preview	public.ecr.aws/lambda/dotnet@sha256:42082beb8d59e791623981f894ecfb9286413178fd2541ccb8c85488b66fac28
public.ecr.aws/lambda/dotnet:9	public.ecr.aws/lambda/dotnet@sha256:2f5f8cefa06decf77f044d2e2547a3796d32e36d1074e9af342cca3f431db761
public.ecr.aws/lambda/dotnet:8	public.ecr.aws/lambda/dotnet@sha256:df95ced9d1b4e777fd23379b2cc9ca5f50df5fd7f915c5a79c1c124a05e24ab0
public.ecr.aws/lambda/ruby:latest	public.ecr.aws/lambda/ruby@sha256:8ce43bc4e5c0a7047d81a99d2f2ccc23d6ad96127d7baaf50cb2036a896a7b38
public.ecr.aws/lambda/ruby:3.4	public.ecr.aws/lambda/ruby@sha256:8ce43bc4e5c0a7047d81a99d2f2ccc23d6ad96127d7baaf50cb2036a896a7b38
public.ecr.aws/lambda/ruby:3.3	public.ecr.aws/lambda/ruby@sha256:a4ad78cc251fbb3c9abe9a77ab4653280721272025f478bb3796f67c7267fc87

---

Description

Issue summary: A timing side-channel which could potentially allow remote
recovery of the private key exists in the SM2 algorithm implementation on 64 bit
ARM platforms.

Impact summary: A timing side-channel in SM2 signature computations on 64 bit
ARM platforms could allow recovering the private key by an attacker..

While remote key recovery over a network was not attempted by the reporter,
timing measurements revealed a timing signal which may allow such an attack.

OpenSSL does not directly support certificates with SM2 keys in TLS, and so
this CVE is not relevant in most TLS contexts. However, given that it is
possible to add support for such certificates via a custom provider, coupled
with the fact that in such a custom provider context the private key may be
recoverable via remote timing measurements, we consider this to be a Moderate
severity issue.

The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
issue, as SM2 is not an approved algorithm.

---

Remediation Steps

• Update the affected package openssl-fips-provider-latest from version 1:3.2.2-1.amzn2023.0.1 to 1:3.2.2-1.amzn2023.0.2.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.