PT-2025-20927 · Unknown+1 · Openpubkey+1

Ethan Heilman · Published 2025-05-13 · Updated 2025-05-23 · CVE-2025-3757

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: OpenPubkey versions prior to 0.10.0

Description: The issue allows a specially crafted JWS to bypass signature verification.

Recommendations: For versions prior to 0.10.0, update to version 0.10.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the JWS verification function until a patch is available. Avoid using the JWS verification in sensitive transactions until the issue is resolved.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

CWE-305

Related Identifiers

CVE-2025-3757

GHSA-537F-GXGM-3JJQ

GO-2025-3679

OPENSUSE-SU-2025:15135-1

Affected Products

Debian

Openpubkey

References · 29

• https://osv.dev/vulnerability/CVE-2025-3757 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15135-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-3757 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-3757 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3679 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-3757 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-3757 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3757 · Security Note
• https://osv.dev/vulnerability/GHSA-537f-gxgm-3jjq · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-3757 · Security Note
• https://github.com/openpubkey/openpubkey/security/advisories/GHSA-537f-gxgm-3jjq · Note
• https://github.com/openpubkey/openpubkey · Note
• https://suse.com/security/cve/CVE-2025-46721 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/QOPKRPL75SZMLT3YSQAZEDWH7RBRXGJK · Note
• https://suse.com/security/cve/CVE-2025-4658 · Note