PT-2025-30102 · Wolfssl+1 · Wolfssl+1

Per Allansson · Published 2025-07-18 · Updated 2026-01-15 · CVE-2025-7394

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wolfSSL (affected versions not specified)

Description The OpenSSL compatibility layer implementation had an issue with the RAND poll() function, potentially leading to predictable values returned from RAND bytes() after a fork() call. This could result in weak or predictable random numbers in applications using RAND bytes() and performing fork() operations. The issue does not affect internal TLS operations. A code change was implemented to reseed the Hash-DRBG after detecting a new process, similar to OpenSSL’s behavior.

Recommendations Update to the latest version of wolfSSL.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-338

Related Identifiers

CVE-2025-7394

Affected Products

Debian

Wolfssl

References · 17

• https://osv.dev/vulnerability/CVE-2025-7394 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7394 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-7394 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-7394 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-7394 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-7394 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-7394 · Vendor Advisory
• https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md#wolfssl-release-582-july-17-2025 · Note
• https://github.com/wolfSSL/wolfssl/pull/8867 · Note
• https://github.com/wolfSSL/wolfssl/pull/8849 · Note
• https://github.com/wolfSSL/wolfssl/pull/8898 · Note
• https://reddit.com/r/debian/comments/1n79g7f/debian_131_and_1212_20250906 · Reddit Post
• https://twitter.com/wolfSSL/status/2011589262009897197 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1946383019117322469 · Twitter Post
• https://t.me/cvetracker/28184 · Telegram Post