CVE-2023-29480

Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.

7.5 HighFix available

CVE-2023-29480 is a high vulnerability (CVSS 7.5) in Ribose Rnp, published April 24, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in rnp 0.16.3-1.

Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.41%Up 0.4 points since Apr 25, 2023

What each source reports

NVD Score used 7.5

Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.

Record: CVE-2023-29480
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-312
Updated: 2026-11-02

CVE List 7.5

Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.

Record: CVE-2023-29480
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-312
Updated: 2026-11-02

EUVDEUVD-2023-33048 7.5

Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.

Record: EUVD-2023-33048
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vrmf-9x5h-2hr7 7.5

Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.

Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.

Record: GHSA-vrmf-9x5h-2hr7
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-312
Updated: 2026-11-02

OSV 7.5

Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.

Record: CVE-2023-29480
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-29480 7.5

Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.

Record: DEBIAN-CVE-2023-29480
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-29480 7.5

Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.

Record: UBUNTU-CVE-2023-29480
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVopenSUSE-SU-2024:12995-1 No score

librnp0-0.16.3-1.1 on GA media

These are all security issues fixed in the librnp0-0.16.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:12995-1
Updated: 2026-11-02

Affected products

ribose rnp

Affected packages

Affected packages
Package	Affected	Fixed
`rnp` Debian:12	before 0.16.3-1	0.16.3-1
`rnp` Debian:13	before 0.16.3-1	0.16.3-1
`rnp` Debian:14	before 0.16.3-1	0.16.3-1
`rnp` Ubuntu:22.04:LTS	All versions, plus listed versions 0.14.0-60.15.2-6build1	None known
`rnp` Ubuntu:24.04:LTS	All versions, plus listed versions 0.17.0-3	None known
`rnp` Ubuntu:25.10	All versions, plus listed versions 0.17.1-1	None known
`rnp` Ubuntu:26.10	All versions, plus listed versions 0.18.1-1build10.18.1-1.10.18.1-1.1build1	None known
`rnp` Ubuntu:26.04:LTS	All versions, plus listed versions 0.17.1-10.18.0-40.18.1-10.18.1-1build1	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Affected products

Affected packages

History

References