SB2026020404 - SUSE update for libsodium

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026020404

SB2026020404 - SUSE update for libsodium

Published: February 4, 2026

Security Bulletin ID SB2026020404
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Cryptographic issues (CVE-ID: CVE-2025-15444)

CWE-ID: CWE-310 - Cryptographic Issues

CVSSv4: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to read and manipulate data.

The vulnerability exists due to usage of a vulnerable version of libsodium described as #VU120975 (CVE-2025-69277). A remote attacker can read or manipulate encrypted data.


2) Cryptographic issues (CVE-ID: CVE-2025-69277)

CWE-ID: CWE-310 - Cryptographic Issues

CVSSv4: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to read or manipulate encrypted data.

The vulnerability exists due to an error within the ge25519_is_on_main_subgroup() function in src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c  in atypical use cases involving certain custom cryptography or untrusted data passed to crypto_core_ed25519_is_valid_point(). A remote attacker can read or manipulate encrypted data.


Remediation

Install update from vendor's website.

References