CVE-2025-15444

Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium

libsodium <= 1.0.20 or a version of libsodium released before December 30, 2025 contains a vulnerability documented as CVE-2025-69277  https://www.cve.org/CVERecord?id=CVE-2025-69277 .

The libsodium vulnerability states:

In atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

0.000042 includes a version of libsodium updated to 1.0.20-stable, released January 3, 2026, which includes a fix for the vulnerability.

These are all security issues fixed in the libsodium-devel-1.0.21-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libsodium fixes the following issues:

• CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).

This update for libsodium fixes the following issues:

Security fixes:

• CVE-2025-15444: Cryptographic bypass via improper elliptic curve point validation (bsc#1256070).
• CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point function (bsc#1255764).

Other fixes:

• Update to 1.0.21

• The new crypto_ipcrypt_* functions implement mechanisms for securely encrypting and anonymizing IP addresses.
• The sodium_bin2ip and sodium_ip2bin helper functions have been added to complement the crypto_ipcrypt_* functions and easily convert addresses between bytes and strings.
• XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are
• standard extendable output functions. From input of any length, they can derive output of any length with the same properties as hash functions. These primitives are required by many post-quantum mechanisms, but can also be used for a wide range of applications, including key derivation, session encryption and more.
• Performance of AES256-GCM and AEGIS on ARM has been improved with some compilers
• Security: optblockers have been introduced in critical code paths to prevent compilers from introducing unwanted side channels via conditional jumps. This was observed on RISC-V targets with specific compilers and options.
• Security: crypto_core_ed25519_is_valid_point() now properly rejects small-order points that are not in the main subgroup
• ((nonnull)) attributes have been relaxed on some crypto_stream* functions to allow NULL output buffers when the output length is zero
• A cross-compilation issue with old clang versions has been fixed
• crypto_aead_aes256gcm_is_available is exported to JavaScript
• Security: memory fences have been added after MAC verification in AEAD to prevent speculative access to plaintext before authentication is complete
• Assembly files now include .gnu.property notes for proper IBT and Shadow Stack support when building with CET instrumentation.

This update for libsodium fixes the following issues:

• CVE-2025-15444: fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).

This update for libsodium fixes the following issues:

• CVE-2025-15444: fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).

This update for libsodium fixes the following issues:

• CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).
• CVE-2025-69277: Fixed incorrect validation of elliptic curve points in crypto_core_ed25519_is_valid_point function (bsc#1255764).

This update for libsodium fixes the following issues:

• CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).
• CVE-2025-69277: Fixed incorrect validation of elliptic curve points in crypto_core_ed25519_is_valid_point function (bsc#1255764).

This update for libsodium fixes the following issues:

• CVE-2025-15444: missing checks when validating elliptic curve points allows for cryptographic bypass (bsc#1256070).

This update for libsodium fixes the following issues:

• CVE-2025-15444: missing checks when validating elliptic curve points allows for cryptographic bypass (bsc#1256070).

This update for libsodium fixes the following issues:

• CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).
• CVE-2025-69277: Fixed incorrect validation of elliptic curve points in crypto_core_ed25519_is_valid_point function (bsc#1255764).

This update for libsodium fixes the following issues:

• CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).
• CVE-2025-69277: Fixed incorrect validation of elliptic curve points in crypto_core_ed25519_is_valid_point function (bsc#1255764).

This update for libsodium fixes the following issues:

• CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).

This update for libsodium fixes the following issues:

• CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).

This update for libsodium fixes the following issues:

Security fixes:

• CVE-2025-15444: Cryptographic bypass via improper elliptic curve point validation (bsc#1256070).
• CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point function (bsc#1255764).

Other fixes:

• Update to 1.0.21

• The new crypto_ipcrypt_* functions implement mechanisms for securely encrypting and anonymizing IP addresses.
• The sodium_bin2ip and sodium_ip2bin helper functions have been added to complement the crypto_ipcrypt_* functions and easily convert addresses between bytes and strings.
• XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are
• standard extendable output functions. From input of any length, they can derive output of any length with the same properties as hash functions. These primitives are required by many post-quantum mechanisms, but can also be used for a wide range of applications, including key derivation, session encryption and more.
• Performance of AES256-GCM and AEGIS on ARM has been improved with some compilers
• Security: optblockers have been introduced in critical code paths to prevent compilers from introducing unwanted side channels via conditional jumps. This was observed on RISC-V targets with specific compilers and options.
• Security: crypto_core_ed25519_is_valid_point() now properly rejects small-order points that are not in the main subgroup
• ((nonnull)) attributes have been relaxed on some crypto_stream* functions to allow NULL output buffers when the output length is zero
• A cross-compilation issue with old clang versions has been fixed
• crypto_aead_aes256gcm_is_available is exported to JavaScript
• Security: memory fences have been added after MAC verification in AEAD to prevent speculative access to plaintext before authentication is complete
• Assembly files now include .gnu.property notes for proper IBT and Shadow Stack support when building with CET instrumentation.

This update for libsodium fixes the following issues:

Security fixes:

• CVE-2025-15444: Cryptographic bypass via improper elliptic curve point validation (bsc#1256070).
• CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point function (bsc#1255764).

Other fixes:

• Update to 1.0.21

• The new crypto_ipcrypt_* functions implement mechanisms for securely encrypting and anonymizing IP addresses.
• The sodium_bin2ip and sodium_ip2bin helper functions have been added to complement the crypto_ipcrypt_* functions and easily convert addresses between bytes and strings.
• XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are
• standard extendable output functions. From input of any length, they can derive output of any length with the same properties as hash functions. These primitives are required by many post-quantum mechanisms, but can also be used for a wide range of applications, including key derivation, session encryption and more.
• Performance of AES256-GCM and AEGIS on ARM has been improved with some compilers
• Security: optblockers have been introduced in critical code paths to prevent compilers from introducing unwanted side channels via conditional jumps. This was observed on RISC-V targets with specific compilers and options.
• Security: crypto_core_ed25519_is_valid_point() now properly rejects small-order points that are not in the main subgroup
• ((nonnull)) attributes have been relaxed on some crypto_stream* functions to allow NULL output buffers when the output length is zero
• A cross-compilation issue with old clang versions has been fixed
• crypto_aead_aes256gcm_is_available is exported to JavaScript
• Security: memory fences have been added after MAC verification in AEAD to prevent speculative access to plaintext before authentication is complete
• Assembly files now include .gnu.property notes for proper IBT and Shadow Stack support when building with CET instrumentation.

This update for libsodium fixes the following issues:

Update to 1.0.22 (jsc#PED-16890):

• Post-quantum key encapsulation is now available. ML-KEM768, the NIST-standardized lattice-based KEM, is accessible through the crypto_kem_mlkem768_*() functions.
• X-Wing, a hybrid KEM combining ML-KEM768 with X25519 for protection against both classical and quantum adversaries, is available through the crypto_kem_*() functions. X-Wing is the recommended KEM for most applications.
• SHA-3 hash functions are now available as crypto_hash_sha3256_() and crypto_hash_sha3512_(), with both one-shot and streaming APIs.
• Performance: NEON optimizations for Argon2 on ARM platforms.
• Performance: SHA3 (Keccak1600) now leverages ARM SHA3 instructions when available on ARM platforms.
• Performance: WebAssembly SIMD implementations of Argon2 have been added.
• XOF state alignment has been relaxed.
• crypto_core_keccak1600_state has been added.
• Export missing crypto_ipcrypt_nd_keygen() helper function.
• crypto_auth_hmacsha256_init and crypto_auth_hmacsha512_init now accept NULL key pointers (with a zero key length), for consistency with other _init functions.
• Fixed compilation with GCC on aarch64 and gcc 4.x.
• On aarch64, aes256-gcm is now enabled even when not using clang, including MSVC.
• Libsodium can be directly used as a dependency in a Zig project.

Update to 1.0.21 (bsc#1256070, CVE-2025-15444, bsc#1255764, CVE-2025-69277):

• The new crypto_ipcrypt_* functions implement mechanisms for securely encrypting and anonymizing IP addresses.
• The sodium_bin2ip and sodium_ip2bin helper functions have been added to complement the crypto_ipcrypt_* functions and easily convert addresses between bytes and strings.
• XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are
• standard extendable output functions. From input of any length, they can derive output of any length with the same properties as hash functions. These primitives are required by many post-quantum mechanisms, but can also be used for a wide range of applications, including key derivation, session encryption and more.
• Performance of AES256-GCM and AEGIS on ARM has been improved with some compilers
• Security: optblockers have been introduced in critical code paths to prevent compilers from introducing unwanted side channels via conditional jumps. This was observed on RISC-V targets with specific compilers and options.
• Security: crypto_core_ed25519_is_valid_point() now properly rejects small-order points that are not in the main subgroup
• ((nonnull)) attributes have been relaxed on some crypto_stream* functions to allow NULL output buffers when the output length is zero
• A cross-compilation issue with old clang versions has been fixed
• crypto_aead_aes256gcm_is_available is exported to JavaScript
• Security: memory fences have been added after MAC verification in AEAD to prevent speculative access to plaintext before authentication is complete
• Assembly files now include .gnu.property notes for proper IBT and Shadow Stack support when building with CET instrumentation.

Update to 1.0.20:

• build system updates and portability fixes

Includes changes from 1.0.19:

• New AEADs: AEGIS-128L and AEGIS-256

• The HKDF key derivation mechanism, required by many standard

  protocols

• A test designed to trigger an OOM condition didn't work on Linux systems with memory overcommit turned on. It has been
• Emscripten: UTF8ToString() is now exported since
• New target: WebAssembly/WASI
• New functions to map a hash to an edwards25519 point or get a random point:
• crypto_core_ed25519_scalar_mul() has been implemented for
• Support for the Ristretto group has been implemented for
• Bug fix: sodium_pad() didn't properly support block sizes
• JS/WebAssembly: some old iOS versions can't…