CVE-2025-67897 | THREATINT

Description

In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.

PUBLISHED Reserved 2025-12-14 | Published 2025-12-14 | Updated 2025-12-15 | Assigner mitre

MEDIUM: 5.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Problem types

CWE-195 Signed to Unsigned Conversion Error

Product status

Default status

unaffected

Any version before 2.1.0

affected

References

gitlab.com/...ommit/b59886e5e7bdf7169ed330f309a6633d131776e5

bugs.debian.org/1122582

gitlab.com/...5e7bdf7169ed330f309a6633d131776e5/openpgp/NEWS

cve.org (CVE-2025-67897)

nvd.nist.gov (CVE-2025-67897)

Download JSON