PT-2025-9525 · Aes-Gcm · Aes-Gcm

Thealtofwar · Published 2025-03-03 · Updated 2025-03-04 · CVE-2025-27498

Positive Technologies (AI Summary)

CVSS v4.0

5.6

Medium

Base vector

AV:L/AC:H/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions aes-gcm versions prior to 0.4.3

Description The issue arises in the decrypt in place detached function, where the decrypted ciphertext is exposed even if the tag is incorrect. This occurs because the tag verification in the decrypt inplace function returns an error with the plaintext contents still in the buffer.

Recommendations For versions prior to 0.4.3, update to version 0.4.3 to resolve the issue.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2025-27498

GHSA-R38M-44FW-H886

Affected Products

Aes-Gcm

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27498.json · Exploit
• https://cve.org/CVERecord?id=CVE-2025-27498 · Security Note
• https://ubuntu.com/security/CVE-2025-27498 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-27498 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r38m-44fw-h886 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27498 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27498 · Vendor Advisory
• https://github.com/RustCrypto/AEADs/security/advisories/GHSA-r38m-44fw-h886 · Note
• https://github.com/RustCrypto/AEADs/commit/d1d749ba57e38e65b0e037cd744d0b17f7254037 · Note
• https://github.com/RustCrypto/AEADs · Note
• https://t.me/cvedetector/19372 · Telegram Post
• https://twitter.com/CVEnew/status/1896767598194209171 · Twitter Post