Vulnerabilities in OpenSSL 3.0.20 delivered in CAPKI 6.0.3 bundled with SiteMinder 12.9 Policy Server
Article ID: 452920
Updated On:
Products
Issue/Introduction
A security scan may return a flag for the following files on the SiteMinder 12.9 Policy Server:
LINUX:
/<Install_Dir>/CA/siteminder/CAPKI/CAPKI6/Linux/amd64/64/lib/libcaopenssl_ssl.so
/<Install_Dir>/CA/siteminder/CAPKI/CAPKI6/Linux/amd64/64/lib/libcaopenssl_crypto.so
WINDOWS:
<Install_Dir>\CA\siteminder\etpki-install\CAPKI6\Windows\amd64\64\lib\libcaopenssl_ssl.so
<Install_Dir>\CA\siteminder\etpki-install\CAPKI6\Windows\amd64\64\lib\libcaopenssl_crypto.so
CAPKI (Previously known as ETPKI) is a C language-based Software Development Kit (SDK) that provides CA Development Community with features required to implement Information Security services in its products. CAPKI is a wrapper on OpenSSL which is robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.
NOTE: Siteminder Policy Server r12.8.8.1 uses CAPKI 5.2.x built on OpenSSL 1.0.2. For CAPKI on Policy Server12.8.8.1 and older, use the following KB:
Environment
PRODUCT: Symantec Siteminder
COMPONENT: Policy Server
VERSION: 12.9 (Only)
OPERATING SYSTEM: Windows and Linux
Cause
CAPKI (Previously known as ETPKI) is a wrapper on OpenSSL. CAPKI 6.0.x is built with OpenSSL 3.0.x
The SiteMinder Policy Server ships with the following versions of CAPKI:
SiteMinder Policy Server 12.9 is shipped with CAPKI 6.0.1.0
KB 431025 (Archived) Delivered OpenSSL 3.0.18 in CAPKI 6.0.2
KB 440135 (Archived) Delivered OpenSSL 3.0.20 in CAPKI 6.0.3
CAPKI 6.0.3 and older compiled with versions of OpenSSL 3.0.20 and older have vulnerabilities (CVE's) published.
Resolution
Upgrade to CAPKI 6.0.4 on the Siteminder 12.9 Policy Server using this KB.
CAPKI 6.0.4 has been compiled with OpenSSL 3.0.21.
This solution applies to the following SiteMinder Policy Server versions:
- r12.9 ONLY
LINUX
1) Download "etpki-install_6_0_4_linux.zip" from this KB.
2) Copy "etpki-install_6_0_4_linux.zip" to the Siteminder Policy Server on Linux and decompress it. This will create the directory /etpki-install/ in the same directory you placed "etpki-install_6_0_4_linux.zip"
3) Run the Policy Server environment variable scripts
cd /<Install_Dir>/CA/siteminder/
. ./ca_ps_env.ksh
4) Verify the Policy Server environment variables
echo $NETE_PS_ROOT
echo $CAPKIHOME
5) Stop the Policy Server
6) Change to the following directory:
cd $NETE_PS_ROOT
7) Backup the '/CAPKI/' directory by renaming it '/CAPKI.BAK'
mv CAPKI CAPKI.BAK
8) Copy the '/etpki-install/' directory from "etpki-install_6_0_4_linux.zip" to /<Install_Dir>/CA/siteminder/
9) Change to the following directory:
cd $NETE_PS_ROOT/etpki-install/redistrib/
10) Ensure the user has execute permissions on the installation media (setup)
11) Run the following command:
./setup install caller=ps12 instdir=$NETE_PS_ROOT
NOTE: This will create a new '/<Install_Dir>/CA/siteminder/CAPKI/CAPKI6/' directory
12) Verify/Modify the $CAPKIHOME variable in the environment variable script:
/<Install_Dir>/CA/siteminder/ca_ps_env.ksh
CAPKIHOME=$NETE_PS_ROOT/CAPKI
export CAPKIHOME
13) Run the updated Policy Environment variable script.
cd /<Install_Dir>/CA/siteminder/
. ./ca_ps_env.ksh
14) Start the Policy Server
15) Validate Policy Server functionality
16) Delete the following files:
/<Install_Dir>/CA/siteminder/CAPKI.BAK
17) Look for any of the following directories*:
/<Install_Dir>/CA/SharedComponents/CAPKI
/<Install_Dir>/CA/SC/CAPKI
NOTE: These directories may not exist in your system. If they do, you will need to determine which application is using them. If there are no other applications using these CAPKI instances, then they can be removed.
Siteminder Default: <Install_Dir>/CA/secure-proxy/agentframework/CAPKI
Directory Server Default: <Install_Dir>/CA/Directory/dxserver/lib/capki/
WINDOWS
1) Download "etpki-install_6_0_3_OpenSSL3_0_20_win64.zip" from this KB.
2) Copy "etpki-install_6_0_3_OpenSSL3_0_20_win64.zip" to the Policy Server on Windows and decompress it. This will create the directory 'etpki-install' in the same directory you placed "etpki-install_6_0_4_linux.zip"
3) Stop the Policy Server
4) Change to the following directory:
<Drive>:\<Install_Dir>\CA\siteminder\
5) Backup the '\CAPKI\' directory by renaming it '\CAPKI.BAK\'
ren CAPKI CAPKI.BAK
6) Copy the '/etpki-install/' directory from "etpki-install_6_0_3_OpenSSL3_0_20_win64.zip" to <Drive>:\<Install_Dir>\CA\siteminder\
7) Open a command prompt using cmd.exe as an administrator (Run As Administrator)
8) Change to the following directory:
<Drive>:\<Install_Dir>\CA\siteminder\
9) Run the Policy Server environment variable script
ca_ps_env.bat
10) Change to the following directory:
<Drive>:\<Install_Dir>\CA\siteminder\etpki-install\redistrib\
11) Run the following command:
setup.exe install caller=ps12 instdir="%NETE_PS_ROOT%"
NOTE: This will create the following directories:
'<Drive>:\<Install_Dir>\CA\siteminder\CAPKI\CAPKI6\Windows\amd64\64\
12) Start the Policy Server
13) Validate Policy Server functionality
14) Delete the following files:
<Drive>:\<Install_Dir>\CA\siteminder\CAPKI.BAK
15) Check for the to the following directories:
<Install_Dir>\CA\SharedComponents\CAPKI
<Install_Dir>\CA\SC\CAPKI
NOTE: These directories may not exist in your system. If they do, you will need to determine which application is using them. If there are no other applications using these CAPKI instances, then they can be removed.
SiteMinder Access Gateway Default: <Install_Dir>\CA\secure-prox\agentframework\CAPKI
SiteMinder Policy Server Default: <Install_Dir>\CA\siteminder\CAPKI
Symantec Directory Server Default: <Install_Dir>\CA\Directory\dxserver\lib\capki/
Additional Information
SiteMinder r12.9
KB 453050 Vulnerability in OpenSSL 3.0.20 in CAPKI 6.0.3 and older on SiteMinder Access Gateway Server 12.9
KB 452920 Vulnerabilities in OpenSSL 3.0.20 delivered in CAPKI 6.0.3 bundled with SiteMinder 12.9 Policy Server
SiteMinder r12.8.8.1 and Older
KB 453623 Vulnerability in OpenSSL 1.0.2zp and older in CAPKI 5.2.18 and older on SiteMinder 12.8.x Agent for Sharepoint
KB 453596 Vulnerability in OpenSSL 1.0.2zp and older in CAPKI 5.2.18 and older on SiteMinder Web Agents
KB 453595 Vulnerability in OpenSSL 1.0.2zp and older in CAPKI 5.2.18 and older on SiteMinder Access Gateway Server 12.8.8.1 and older
KB 453434 Vulnerability in OpenSSL 1.0.2zp and older in CAPKI 5.2.18 and older on SiteMinder Policy Server Server 12.8.8.1 and older
OpenSSL 3.0.20 within CAPKI 6.0.3 remediates the following CVE's:
CVE-2026-34180
CVE-2026-34182
CVE-2026-42766
CVE-2026-42767
CVE-2026-42770
CVE-2026-45445
CVE-2026-45446
CVE-2026-45447
CVE-2026-7383
CVE-2026-9076
CVE-2026-28387
CVE-2026-28388
CVE-2026-28389
CVE-2026-28390
CVE-2026-31789
CVE-2026-31790
CVE-2025-15467
CVE-2025-68160
CVE-2025-69418
CVE-2025-69419
CVE-2025-69420
CVE-2025-69421
CVE-2026-22795
CVE-2026-22796
CVE-2025-9230
CVE-2025-9232
Attachments
Feedback
