PT-2025-47788 · Rnp · Rnp

Johannes Roth · Published 2025-11-21 · Updated 2025-11-27 · CVE-2025-13470

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:H/U:Red

Name of the Vulnerable Software and Affected Versions RNP version 0.18.0

Description A regression in RNP version 0.18.0 causes the symmetric session key used for Public-Key Encrypted Session Key (PKESK) packets to remain uninitialized, resulting in it always being an all-zero byte array. This allows trivial decryption of data encrypted using public-key encryption by supplying an all-zero session key, fully compromising confidentiality. The issue affects only public key encryption (PKESK packets) and does not impact passphrase-based encryption (SKESK packets). The root cause is a vulnerable session key buffer used in PKESK packet generation, introduced by commit 7bd9a8dc356aae756b40755be76d36205b6b161a, where initialization logic inside encrypted build skesk() only randomized the key for the SKESK path and omitted it for the PKESK path.

Recommendations Update to a newer version of RNP that addresses this issue.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2025-13470

OPENSUSE-SU-2025:15762-1

OPENSUSE-SU-2025:20116-1

Affected Products

Rnp

References · 24

• https://security-tracker.debian.org/tracker/CVE-2025-13470 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-13470 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13470 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-13470 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-13470 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-13470 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-13470 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15762-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:20116-1 · Vendor Advisory
• https://open.ribose.com/advisories/ra-2025-11-20 · Vendor Advisory
• https://github.com/rnpgp/rnp/commit/7bd9a8dc356aae756b40755be76d36205b6b161a · Note
• https://github.com/rnpgp/rnp/releases/tag/v0.18.1 · Note
• https://launchpad.net/ubuntu/+source/rnp · Note
• https://twitter.com/CVEnew/status/1991922825037308240 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2415863 · Note