PT-2025-20928 · Unknown+1 · Openpubkey+1

Ethan Heilman · Published 2025-05-13 · Updated 2025-05-20 · CVE-2025-4658

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: OpenPubkey library versions prior to 0.10.0 OPKSSH versions prior to 0.5.0

Description: The issue allows a specially crafted JWS to bypass signature verification. This affects OPKSSH as it depends on the OpenPubkey library for authentication, enabling an attacker to bypass OPKSSH authentication.

Recommendations: For OpenPubkey library versions prior to 0.10.0, update to version 0.10.0 or later to resolve the issue. For OPKSSH versions prior to 0.5.0, update to version 0.5.0 or later to resolve the issue.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

CWE-305

Related Identifiers

CVE-2025-4658

GHSA-56WX-66PX-9J66

GO-2025-3680

OPENSUSE-SU-2025:15135-1

Affected Products

Opkssh

Openpubkey

References · 27

• https://osv.dev/vulnerability/openSUSE-SU-2025:15135-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4658 · Security Note
• https://osv.dev/vulnerability/GHSA-56wx-66px-9j66 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-4658 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-4658 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-4658 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3680 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-4658 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-4658 · Vendor Advisory
• https://github.com/openpubkey/opkssh/security/advisories/GHSA-56wx-66px-9j66 · Note
• https://github.com/openpubkey/opkssh · Note
• https://suse.com/security/cve/CVE-2025-46721 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/QOPKRPL75SZMLT3YSQAZEDWH7RBRXGJK · Note
• https://suse.com/security/cve/CVE-2025-46735 · Note
• https://suse.com/security/cve/CVE-2025-4658 · Note