CVE-2025-13402
librnp0-0.18.1-1.1 on GA media
No score
[RNP PKESK Session Keys Generated as All-Zero]
What each source reports
OSVopenSUSE-SU-2025:15762-1 No score
librnp0-0.18.1-1.1 on GA media
These are all security issues fixed in the librnp0-0.18.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15762-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:20116-1 No score
Security update for rnp
This update for rnp fixes the following issues:
- update to 0.18.1:
- CVE-2025-13470: PKESK (public-key encrypted) session keys were generated as all-zero, allowing trivial decryption of messages encrypted with public keys only (boo#1253957, CVE-2025-13402)
- Record
openSUSE-SU-2025:20116-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-13402 No score
[RNP PKESK Session Keys Generated as All-Zero]
- Record
UBUNTU-CVE-2025-13402- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rnpUbuntu:22.04:LTS |
All versions, plus listed versions 0.14.0-60.15.2-6build1 |
None known |
rnpUbuntu:24.04:LTS |
All versions, plus listed versions 0.17.0-3 |
None known |
rnpUbuntu:25.10 |
All versions, plus listed versions 0.17.1-1 |
None known |
rnpUbuntu:26.10 |
All versions, plus listed versions 0.18.1-1build10.18.1-1.10.18.1-1.1build1 |
None known |
rnpUbuntu:26.04:LTS |
All versions, plus listed versions 0.17.1-10.18.0-40.18.1-10.18.1-1build1 |
None known |
rnpopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 0.18.1-1.1 | 0.18.1-1.1 |
rnpopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 0.18.1-bp160.1.1 | 0.18.1-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-13402 is a vulnerability with no CVSS score yet in rnp, published January 1, 0001. No source lists public exploit code. No source names a fixed version.