CVE-2025-69421 (HIGH): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2025-69421	HIGH	openssl-fips-provider-latest	1:3.2.2-1.amzn2023.0.4	1:3.2.2-1.amzn2023.0.5	2026-01-27T16:16:34.437Z	2026-02-19T10:18:17.288161843Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/provided:latest	public.ecr.aws/lambda/provided@sha256:059ed067a8e796d891100888928e32cde75d63d459617260a7901e217a7249d6
public.ecr.aws/lambda/provided:al2023	public.ecr.aws/lambda/provided@sha256:059ed067a8e796d891100888928e32cde75d63d459617260a7901e217a7249d6
public.ecr.aws/lambda/python:latest	public.ecr.aws/lambda/python@sha256:f1025b56c40ecc2a1b6becc0ae87cadbc31bee42e72dc211170cb2f5a738b1be
public.ecr.aws/lambda/python:3.14	public.ecr.aws/lambda/python@sha256:4a260ea82736166accb2cb9fa1b3a180ca1e26cf5f9714e1e382d290ddb4e409
public.ecr.aws/lambda/python:3.13	public.ecr.aws/lambda/python@sha256:f1025b56c40ecc2a1b6becc0ae87cadbc31bee42e72dc211170cb2f5a738b1be
public.ecr.aws/lambda/python:3.12	public.ecr.aws/lambda/python@sha256:663ac51bfafe5fb4aa9084936611740c97bf9ded30ba815e971fe72971b34d67
public.ecr.aws/lambda/nodejs:latest	public.ecr.aws/lambda/nodejs@sha256:75324e6335efc458856ddcb49429a5806fa66c581529746296ded84f0f8fdd92
public.ecr.aws/lambda/nodejs:24	public.ecr.aws/lambda/nodejs@sha256:2ae0aecfac970190fe1fa2f9de439fb35340d285eb29a715ce6daf18eda7f54c
public.ecr.aws/lambda/nodejs:22	public.ecr.aws/lambda/nodejs@sha256:75324e6335efc458856ddcb49429a5806fa66c581529746296ded84f0f8fdd92
public.ecr.aws/lambda/nodejs:20	public.ecr.aws/lambda/nodejs@sha256:b1d950b97aaedc054c6c9c5409c98cf5c8f29de370a6f344113e1aeeaa441707
public.ecr.aws/lambda/java:latest	public.ecr.aws/lambda/java@sha256:34bc510d30a691091930c6636702697ed3911c3c2bf19c8d4ebae91bb1442204
public.ecr.aws/lambda/java:25	public.ecr.aws/lambda/java@sha256:981df5d83afb63cff2fe55bb85f3102e16df1b1134982c16cc5c92a1e20073ac
public.ecr.aws/lambda/java:21	public.ecr.aws/lambda/java@sha256:34bc510d30a691091930c6636702697ed3911c3c2bf19c8d4ebae91bb1442204
public.ecr.aws/lambda/dotnet:latest	public.ecr.aws/lambda/dotnet@sha256:f7ad6fd594bc06108c7fd6fa5a438f8ceb3e3da37aafec7aa4b7cf976969c376
public.ecr.aws/lambda/dotnet:10	public.ecr.aws/lambda/dotnet@sha256:c1a97e4b055ad61ffb87222bd0f04337a63929efa3bec7dbde4844de94d79856
public.ecr.aws/lambda/dotnet:9	public.ecr.aws/lambda/dotnet@sha256:e0c459f568c3b8c0a601a3141de9a8e4bebd9019210e0ff94381686e7ab0621e
public.ecr.aws/lambda/dotnet:8	public.ecr.aws/lambda/dotnet@sha256:f7ad6fd594bc06108c7fd6fa5a438f8ceb3e3da37aafec7aa4b7cf976969c376
public.ecr.aws/lambda/ruby:latest	public.ecr.aws/lambda/ruby@sha256:215348bc5ef325f108229155601a31d5b6b230995eea50531d85094b63b27f2e
public.ecr.aws/lambda/ruby:3.4	public.ecr.aws/lambda/ruby@sha256:215348bc5ef325f108229155601a31d5b6b230995eea50531d85094b63b27f2e
public.ecr.aws/lambda/ruby:3.3	public.ecr.aws/lambda/ruby@sha256:06a25df7835e1450dc54d81401c063762a885ed8c7e9cfd339dc35286b1b17ef

---

Description

Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer
dereference in the PKCS12_item_decrypt_d2i_ex() function.

Impact summary: A NULL pointer dereference can trigger a crash which leads to
Denial of Service for an application processing PKCS#12 files.

The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct
parameter is NULL before dereferencing it. When called from
PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can
be NULL, causing a crash. The vulnerability is limited to Denial of Service
and cannot be escalated to achieve code execution or memory disclosure.

Exploiting this issue requires an attacker to provide a malformed PKCS#12 file
to an application that processes it. For that reason the issue was assessed as
Low severity according to our Security Policy.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,
as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.

---

Remediation Steps

• Update the affected package openssl-fips-provider-latest from version 1:3.2.2-1.amzn2023.0.4 to 1:3.2.2-1.amzn2023.0.5.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.