CVE-2025-67897

In Sequoia before 2.1.0, aeskeyunwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet...

CVE-2025-67897

In Sequoia before 2.1.0, aeskeyunwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet...

CVE-2025-67897: Signed to Unsigned Conversion Error

In Sequoia before 2.1.0, aeskeyunwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet...

PT-2025-54721

In Sequoia before 2.1.0, aes key unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet...

CVE-2025-13470

In RNP version 0.18.0 a refactoring regression causes the symmetric session key used for Public-Key Encrypted Session Key PKESK packets to be left uninitialized except for zeroing, resulting in it always being an all-zero byte array. Any data encrypted using public-key encryption in this release...

CVE-2025-13470: Use of Insufficiently Random Values

In RNP version 0.18.0 a refactoring regression causes the symmetric session key used for Public-Key Encrypted Session Key PKESK packets to be left uninitialized except for zeroing, resulting in it always being an all-zero byte array. Any data encrypted using public-key encryption in this release...

PT-2025-54582

Name of the Vulnerable Software and Affected Versions librnp0-0.18.1-1.1 Description The issue involves RNP PKESK session keys being generated as all-zero. This can lead to security concerns as it compromises the randomness and strength of the generated keys. Recommendations Update to...

Denial Of Service (DoS)

thunderbird is vulnerable to Denial of Service DoS. The vulnerability exists due to incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library causing an application hang resulting in an application crash...

Thunderbird: Hang when processing certain OpenPGP messages

The Mozilla Foundation Security Advisory describes this flaw as: Certain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. Th...

PT-2023-2798

Name of the Vulnerable Software and Affected Versions Ribose RNP versions prior to 0.16.3 Description The issue is related to insufficient input validation when parsing PKESK/SKESK packets in the Ribose RNP library of the Thunderbird email client. Exploitation of this issue may allow a remote...