PT-2025-9525 · Aes-Gcm · Aes-Gcm

Thealtofwar · Publicado 2025-03-03 · Atualizado 2025-03-04 · CVE-2025-27498

Positive Technologies (AI Summary)

CVSS v4.0

5.6

Média

Vetor base

AV:L/AC:H/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions aes-gcm versions prior to 0.4.3

Description The issue arises in the decrypt in place detached function, where the decrypted ciphertext is exposed even if the tag is incorrect. This occurs because the tag verification in the decrypt inplace function returns an error with the plaintext contents still in the buffer.

Recommendations For versions prior to 0.4.3, update to version 0.4.3 to resolve the issue.

Exploit

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2025-27498

GHSA-R38M-44FW-H886

Produtos afetados

Aes-Gcm

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27498.json · Exploit
• https://github.com/RustCrypto/AEADs/security/advisories/GHSA-r38m-44fw-h886 · Nota
• https://github.com/RustCrypto/AEADs/commit/d1d749ba57e38e65b0e037cd744d0b17f7254037 · Nota
• https://github.com/RustCrypto/AEADs · Nota
• https://cve.org/CVERecord?id=CVE-2025-27498 · Nota de Segurança
• https://ubuntu.com/security/CVE-2025-27498 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-27498 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-r38m-44fw-h886 · Aviso do Fabricante
• https://t.me/cvedetector/19372 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-27498 · Nota de Segurança
• https://twitter.com/CVEnew/status/1896767598194209171 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-27498 · Aviso do Fabricante