#VU118816 Use of insufficiently random values in RNP - CVE-2025-13470
Published: November 27, 2025
Vulnerability identifier: #VU118816
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2025-13470
CWE-ID: CWE-330
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
RNP
RNP
Software vendor:
Ribose
Ribose
Description
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the symmetric session key used for Public-Key Encrypted Session Key (PKESK) packets is left uninitialized except for zeroing, resulting in it always being an all-zero byte array. As a result any data encrypted using public-key encryption in this release can be decrypted trivially by supplying an all-zero session key, fully compromising confidentiality.
Remediation
Install updates from vendor's website.
External links
- https://access.redhat.com/security/cve/cve-2025-13402
- https://aur.archlinux.org/packages/rnp
- https://bugzilla.redhat.com/show_bug.cgi?id=2415863
- https://github.com/rnpgp/rnp/commit/7bd9a8dc356aae756b40755be76d36205b6b161a
- https://github.com/rnpgp/rnp/releases/tag/v0.18.1
- https://launchpad.net/ubuntu/+source/rnp
- https://open.ribose.com/advisories/ra-2025-11-20/
- https://packages.gentoo.org/packages/dev-util/librnp