{"id":"CVE-2025-27587","aliases":["DEBIAN-CVE-2025-27587","EUVD-2025-18430","GHSA-jqr3-3jm7-r6cm","SUSE-SU-2025:02042-1","SUSE-SU-2025:02236-1","SUSE-SU-2025:1550-1","SUSE-SU-2025:20406-1","SUSE-SU-2025:20417-1","UBUNTU-CVE-2025-27587","openSUSE-SU-2025:15183-1"],"status":"disputed","title":"OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack,...","description":"OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00447,"percentile":0.39176,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-385"],"published":"2025-05-16T00:16:12Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"Debian:13","package":"openssl","fixed_in":["3.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssl","fixed_in":["3.5.0-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"openssl-3","fixed_in":["3.2.3-150700.5.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openssl-3","fixed_in":["3.1.4-150600.5.27.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"openssl-3","fixed_in":["3.1.4-150600.5.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"openssl-3","fixed_in":["3.1.4-slfo.1.1_5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.10-1","3.0.10-1~deb12u1","3.0.11-1","3.0.11-1~deb12u1","3.0.11-1~deb12u2","3.0.12-1","3.0.12-2","3.0.13-1~deb12u1","3.0.13-1~deb12u2","3.0.14-1~deb12u1","3.0.14-1~deb12u2","3.0.15-1~deb12u1","3.0.16-1~deb12u1","3.0.17-1~deb12u1","3.0.17-1~deb12u2","3.0.17-1~deb12u3","3.0.18-1~deb12u1","3.0.18-1~deb12u2","3.0.19-1~deb12u1","3.0.19-1~deb12u2","3.0.20-1~deb12u1","3.0.20-1~deb12u2","3.0.9-1","3.1.0-1","3.1.1-1","3.1.2-1","3.1.3-1","3.1.4-1","3.1.4-2","3.1.5-1","3.1.5-1.1","3.1.5-1.1+hurd.1","3.2.0-1","3.2.0-2","3.2.1-1","3.2.1-1.1~exp1","3.2.1-2","3.2.1-3","3.2.2-1","3.3.0-1","3.3.0~beta1-1","3.3.1-1","3.3.1-2","3.3.1-5","3.3.1-6","3.3.1-7","3.3.2-1","3.3.2-2","3.4.0-1","3.4.0-2","3.4.0~~beta1-1","3.4.0~~beta1-2","3.4.1-1","3.5.0-1","3.5.0-2","3.5.0-3","3.5.0~~alpha1-1","3.5.0~~beta1-1","3.5.1-1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1","3.5.5-1~deb13u1","3.5.5-1~deb13u2","3.5.6-1~deb13u1","3.5.6-1~deb13u2","3.5.7-1~deb13u1","3.5.7-1~deb13u2","3.6.0-1","3.6.0-2","3.6.0~~alpha1-1","3.6.0~~beta1-1","3.6.1-1","3.6.1-2","3.6.1-3","3.6.2-1","3.6.3-1","3.6.4-1","4.0.0-1","4.0.0~alpha1-1","4.0.0~beta1-1","4.0.1-1","4.0.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150700.5.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150700.5.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.27.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-slfo.1.1_5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-3.1"}]}],"bundled":2}],"references":[{"url":"https://github.com/openssl/openssl/issues/24253","tags":["report"]},{"url":"https://minerva.crocs.fi.muni.cz","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27587","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jqr3-3jm7-r6cm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27587.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-27587","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502042-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236136","tags":["report"]},{"url":"https://bugzilla.suse.com/1236599","tags":["report"]},{"url":"https://bugzilla.suse.com/1243459","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-13176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27587","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502236-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1240366","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251550-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230959","tags":["report"]},{"url":"https://bugzilla.suse.com/1231748","tags":["report"]},{"url":"https://bugzilla.suse.com/1232326","tags":["report"]},{"url":"https://bugzilla.suse.com/1240607","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520406-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520417-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-27587","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-27587","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZEDUJCGPRD4X4W7AN2MXWCAGTZM7PP7E/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4575","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-27587","description":"OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.","status":"disputed","published":"2025-06-16T00:00:00Z","modified":"2025-06-26T16:17:47.596Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-385"],"updated_at":"2026-11-02T14:32:42.751171Z"}],"euvd":[{"id":"EUVD-2025-18430","description":"OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.","status":"published","published":"2025-06-16T00:00:00Z","modified":"2025-06-26T16:17:47Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:16.171648Z"}],"ghsa":[{"id":"GHSA-jqr3-3jm7-r6cm","title":"OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack,...","description":"OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.","status":"published","published":"2025-06-17T00:30:30Z","modified":"2025-06-26T18:32:25Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-385"],"updated_at":"2026-11-02T15:02:49.372577Z"}],"nvd":[{"id":"CVE-2025-27587","description":"OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.","status":"disputed","published":"2025-06-16T22:15:44.093Z","modified":"2026-06-17T09:03:50.853Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-385"],"updated_at":"2026-11-02T14:11:13.247441Z"}],"osv":[{"id":"CVE-2025-27587","description":"OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.","status":"published","published":"2025-06-16T00:00:00Z","modified":"2026-10-28T02:30:45.515063739Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"DEBIAN-CVE-2025-27587","description":"OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.","status":"published","published":"2025-06-16T22:15:44.093Z","modified":"2026-09-01T20:05:45.33086349Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"UBUNTU-CVE-2025-27587","description":"OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.","status":"withdrawn","published":"2025-06-16T22:15:00Z","modified":"2026-07-21T18:26:36.796578387Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"openSUSE-SU-2025:15183-1","title":"libopenssl-3-devel-3.5.0-3.1 on GA media","description":"These are all security issues fixed in the libopenssl-3-devel-3.5.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-30T00:00:00Z","modified":"2026-03-23T04:53:27.35215Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:02042-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2025-27587: timing side-channel vulnerability in the P-384 implementation when used with ECDSA (bsc#1243459).\n- CVE-2024-12797: Fixed that RFC7250 handshakes with unauthenticated servers don't abort as expected. (bsc#1236599)\n- CVE-2024-13176: Fixed timing side-channel in ECDSA signature computation (bsc#1236136)\n","status":"published","published":"2025-06-20T10:38:46Z","modified":"2026-03-23T04:49:33.848739Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02236-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2025-27587: Fixed Minerva side channel vulnerability in P-384 (bsc#1240366).\n\n- Backport mdless cms signing support [jsc#PED-12895]\n\n","status":"published","published":"2025-07-07T12:58:58Z","modified":"2026-03-23T04:49:35.985028Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:1550-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\nSecurity:\n  \n- CVE-2025-27587: Timing side channel vulnerability in the P-384\n  implementation when used with ECDSA in the PPC architecture (bsc#1240366).\n- Missing null pointer check before accessing handshake_func in ssl_lib.c (bsc#1240607).\n  \nFIPS:\n    \n- Disabling EMS in OpenSSL configuration prevents sshd from starting (bsc#1230959, bsc#1232326, bsc#1231748).\n","status":"published","published":"2025-05-16T00:16:12Z","modified":"2026-02-04T02:16:18.025977Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20406-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2025-27587: Fixed Minerva side channel vulnerability in P-384 on PPC arch (bsc#1240366)\n- CVE-2024-13176: Fixed timing side-channel in the ECDSA signature computation (bsc#1236136)\n","status":"published","published":"2025-06-13T11:05:04Z","modified":"2026-03-23T04:48:15.97612Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20417-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2025-27587: Fixed Minerva side channel vulnerability in P-384 (bsc#1240366)\n","status":"published","published":"2025-06-13T10:47:24Z","modified":"2026-03-23T04:50:49.058129Z","updated_at":"2026-11-02T15:53:59.92114Z"}]}}