CVE-2025-13402
librnp0-0.18.1-1.1 on GA media
No score
CVE-2025-13402 is a vulnerability with no CVSS score yet in rnp, published January 1, 1. No source lists public exploit code. No source names a fixed version.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
[RNP PKESK Session Keys Generated as All-Zero]
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rnpUbuntu:22.04:LTS | All versions, plus listed versions 0.14.0-60.15.2-6build1 | None known |
rnpUbuntu:24.04:LTS | All versions, plus listed versions 0.17.0-3 | None known |
rnpUbuntu:25.10 | All versions, plus listed versions 0.17.1-1 | None known |
rnpUbuntu:26.10 | All versions, plus listed versions 0.18.1-1build10.18.1-1.10.18.1-1.1build1 | None known |
rnpUbuntu:26.04:LTS | All versions, plus listed versions 0.17.1-10.18.0-40.18.1-10.18.1-1build1 | None known |
rnpopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 0.18.1-1.1 | 0.18.1-1.1 |
rnpopenSUSE:Leap 16.0 From an advisory covering 2 CVEs | before 0.18.1-bp160.1.1 | 0.18.1-bp160.1.1 |
What each source reports
OSVopenSUSE-SU-2025:15762-1No score
librnp0-0.18.1-1.1 on GA media
These are all security issues fixed in the librnp0-0.18.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15762-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:20116-1No score
Security update for rnp
This update for rnp fixes the following issues:
- update to 0.18.1:
- CVE-2025-13470: PKESK (public-key encrypted) session keys were generated as all-zero, allowing trivial decryption of messages encrypted with public keys only (boo#1253957, CVE-2025-13402)
- Record
openSUSE-SU-2025:20116-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-13402No score
[RNP PKESK Session Keys Generated as All-Zero]
- Record
UBUNTU-CVE-2025-13402- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.