CVE-2025-13470
Description
A flaw was found in RNP. This vulnerability allows for the trivial decryption of data encrypted using public-key encryption, fully compromising confidentiality, via an uninitialized symmetric session key in Public-Key Encrypted Session Key (PKESK) packets, which results in an all-zero byte array.
Statement
No Red Hat products or offerings are affected by this vulnerability.
This vulnerability is Important rather than Moderate because it completely undermines the fundamental security property of public-key encryption: the confidentiality of encrypted data. By leaving the PKESK session key uninitialized and effectively forcing it to an all-zero value, RNP 0.18.0 produces ciphertexts that can be decrypted by any attacker, without requiring the private key, without exploiting side channels, and without meeting any environmental preconditions. This is a direct cryptographic failure, not a partial weakness or a degraded security margin. The break is deterministic, universally exploitable, and affects all data encrypted through the affected PKESK path. As a result, encryption provides no protection whatsoever—equivalent to transmitting plaintext—making the impact complete and immediate confidentiality compromise. Vulnerabilities that convert strong encryption into trivially reversible encryption are categorically high-impact, not moderate, due to their total loss of security guarantees and zero attack complexity.
Mitigation
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
