EUVD-2025-198494

🗓️ 21 Nov 2025 17:05:15Reported by EUVDType

RNP 0.18.0 regression leaves PKESK session key zero, enabling decryption of public-key data with an all-zero key.

Reporter	Title	Published	Views	Family All 41
AlpineLinux	CVE-2025-13470	21 Nov 202517:15	–	alpinelinux
Circl	CVE-2025-13470	21 Nov 202519:42	–	circl
CNNVD	RNP 安全漏洞	19 Nov 202500:00	–	cnnvd
CNNVD	RNP 安全漏洞	21 Nov 202500:00	–	cnnvd
CVE	CVE-2025-13402	19 Nov 202513:56	–	cve
CVE	CVE-2025-13470	21 Nov 202517:05	–	cve
Cvelist	CVE-2025-13470 RNP 0.18.0 Vulnerable PKESK session keys	21 Nov 202517:05	–	cvelist
Debian CVE	CVE-2025-13402	19 Nov 202513:56	–	debiancve
Debian CVE	CVE-2025-13470	21 Nov 202517:05	–	debiancve
Fedora	[SECURITY] Fedora 42 Update: rnp-0.18.1-1.fc42	29 Nov 202517:07	–	fedora

[
  {
    "enisaIdVendor": [
      {
        "id": "1236592a-069f-332d-bfdb-22c24eefef43",
        "vendor": {
          "name": "Ribose"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "85413240-b100-3e1c-8973-cd85f6e1c917",
        "product": {
          "name": "RNP"
        },
        "product_version": "0.18.0"
      }
    ]
  }
]

Source	Link
github	www.github.com/rnpgp/rnp/commit/7bd9a8dc356aae756b40755be76d36205b6b161a
launchpad	www.launchpad.net/ubuntu/+source/rnp
aur	www.aur.archlinux.org/packages/rnp
packages	www.packages.gentoo.org/packages/dev-util/librnp
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
access	www.access.redhat.com/security/cve/cve-2025-13402
cve	www.cve.ribose.com/advisories/ra-2025-11-20/
github	www.github.com/rnpgp/rnp/releases/tag/v0.18.1
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-13470
open	www.open.ribose.com/advisories/ra-2025-11-20

21 Nov 2025 17:35Current

6.5Medium risk

Vulners AI Score6.5

CVSS 48.7

CVSS 3.17.5

EPSS0.00043

SSVC