CVE-2025-69420 (HIGH): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2025-69420	HIGH	openssl-fips-provider-latest	1:3.2.2-1.amzn2023.0.4	1:3.2.2-1.amzn2023.0.5	2026-01-27T16:16:34.317Z	2026-02-19T10:18:17.288161843Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/provided:latest	public.ecr.aws/lambda/provided@sha256:059ed067a8e796d891100888928e32cde75d63d459617260a7901e217a7249d6
public.ecr.aws/lambda/provided:al2023	public.ecr.aws/lambda/provided@sha256:059ed067a8e796d891100888928e32cde75d63d459617260a7901e217a7249d6
public.ecr.aws/lambda/python:latest	public.ecr.aws/lambda/python@sha256:f1025b56c40ecc2a1b6becc0ae87cadbc31bee42e72dc211170cb2f5a738b1be
public.ecr.aws/lambda/python:3.14	public.ecr.aws/lambda/python@sha256:4a260ea82736166accb2cb9fa1b3a180ca1e26cf5f9714e1e382d290ddb4e409
public.ecr.aws/lambda/python:3.13	public.ecr.aws/lambda/python@sha256:f1025b56c40ecc2a1b6becc0ae87cadbc31bee42e72dc211170cb2f5a738b1be
public.ecr.aws/lambda/python:3.12	public.ecr.aws/lambda/python@sha256:663ac51bfafe5fb4aa9084936611740c97bf9ded30ba815e971fe72971b34d67
public.ecr.aws/lambda/nodejs:latest	public.ecr.aws/lambda/nodejs@sha256:75324e6335efc458856ddcb49429a5806fa66c581529746296ded84f0f8fdd92
public.ecr.aws/lambda/nodejs:24	public.ecr.aws/lambda/nodejs@sha256:2ae0aecfac970190fe1fa2f9de439fb35340d285eb29a715ce6daf18eda7f54c
public.ecr.aws/lambda/nodejs:22	public.ecr.aws/lambda/nodejs@sha256:75324e6335efc458856ddcb49429a5806fa66c581529746296ded84f0f8fdd92
public.ecr.aws/lambda/nodejs:20	public.ecr.aws/lambda/nodejs@sha256:b1d950b97aaedc054c6c9c5409c98cf5c8f29de370a6f344113e1aeeaa441707
public.ecr.aws/lambda/java:latest	public.ecr.aws/lambda/java@sha256:34bc510d30a691091930c6636702697ed3911c3c2bf19c8d4ebae91bb1442204
public.ecr.aws/lambda/java:25	public.ecr.aws/lambda/java@sha256:981df5d83afb63cff2fe55bb85f3102e16df1b1134982c16cc5c92a1e20073ac
public.ecr.aws/lambda/java:21	public.ecr.aws/lambda/java@sha256:34bc510d30a691091930c6636702697ed3911c3c2bf19c8d4ebae91bb1442204
public.ecr.aws/lambda/dotnet:latest	public.ecr.aws/lambda/dotnet@sha256:f7ad6fd594bc06108c7fd6fa5a438f8ceb3e3da37aafec7aa4b7cf976969c376
public.ecr.aws/lambda/dotnet:10	public.ecr.aws/lambda/dotnet@sha256:c1a97e4b055ad61ffb87222bd0f04337a63929efa3bec7dbde4844de94d79856
public.ecr.aws/lambda/dotnet:9	public.ecr.aws/lambda/dotnet@sha256:e0c459f568c3b8c0a601a3141de9a8e4bebd9019210e0ff94381686e7ab0621e
public.ecr.aws/lambda/dotnet:8	public.ecr.aws/lambda/dotnet@sha256:f7ad6fd594bc06108c7fd6fa5a438f8ceb3e3da37aafec7aa4b7cf976969c376
public.ecr.aws/lambda/ruby:latest	public.ecr.aws/lambda/ruby@sha256:215348bc5ef325f108229155601a31d5b6b230995eea50531d85094b63b27f2e
public.ecr.aws/lambda/ruby:3.4	public.ecr.aws/lambda/ruby@sha256:215348bc5ef325f108229155601a31d5b6b230995eea50531d85094b63b27f2e
public.ecr.aws/lambda/ruby:3.3	public.ecr.aws/lambda/ruby@sha256:06a25df7835e1450dc54d81401c063762a885ed8c7e9cfd339dc35286b1b17ef

---

Description

Issue summary: A type confusion vulnerability exists in the TimeStamp Response
verification code where an ASN1_TYPE union member is accessed without first
validating the type, causing an invalid or NULL pointer dereference when
processing a malformed TimeStamp Response file.

Impact summary: An application calling TS_RESP_verify_response() with a
malformed TimeStamp Response can be caused to dereference an invalid or
NULL pointer when reading, resulting in a Denial of Service.

The functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()
access the signing cert attribute value without validating its type.
When the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory
through the ASN1_TYPE union, causing a crash.

Exploiting this vulnerability requires an attacker to provide a malformed
TimeStamp Response to an application that verifies timestamp responses. The
TimeStamp protocol (RFC 3161) is not widely used and the impact of the
exploit is just a Denial of Service. For these reasons the issue was
assessed as Low severity.

The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,
as the TimeStamp Response implementation is outside the OpenSSL FIPS module
boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.

OpenSSL 1.0.2 is not affected by this issue.

---

Remediation Steps

• Update the affected package openssl-fips-provider-latest from version 1:3.2.2-1.amzn2023.0.4 to 1:3.2.2-1.amzn2023.0.5.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.