Echo: openssl: security update to 3.0.0

medium Tenable Cloud Security Plugin ID 462397

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by
measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private
key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted
nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via
statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also,
there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is
disputed because the OpenSSL security policy explicitly notes that any side channels which require same
physical system to be detected are outside of the threat model for the software. The timing signal is so
small that it is infeasible to be detected without having the attacking process running on the same
physical system. (CVE-2025-27587)

Solution

Update the openssl library and its related packages to version 3.0.0 or later.

Plugin Details

Severity: Medium

ID: 462397

Version: Revision 1.1

Type: Local

Family: Echo Local Security Checks

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.42

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.6

Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:N/A:N

CVSS Score Source: CVE-2025-27587

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 5/22/2025

Reference Information

CVE: CVE-2025-27587

IAVA: 2025-A-0360-S

Detections

Analytics