CVE-2025-13470

Name	CVE-2025-13470
Description	In RNP version 0.18.0 a refactoring regression causes the symmetric session key used for Public-Key Encrypted Session Key (PKESK) packets to be left uninitialized except for zeroing, resulting in it always being an all-zero byte array. Any data encrypted using public-key encryption in this release can be decrypted trivially by supplying an all-zero session key, fully compromising confidentiality. The vulnerability affects only public key encryption (PKESK packets). Passphrase-based encryption (SKESK packets) is not affected. Root cause: Vulnerable session key buffer used in PKESK packet generation. The defect was introduced in commit `7bd9a8dc356aae756b40755be76d36205b6b161a` where initialization logic inside `encrypted_build_skesk()` only randomized the key for the SKESK path and omitted it for the PKESK path.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1121081

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rnp (PTS)	bookworm	0.16.3-1	fixed
	trixie	0.17.1-1	fixed
	forky, sid	0.18.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
rnp	source	bookworm	(not affected)
rnp	source	trixie	(not affected)
rnp	source	(unstable)	0.18.1-1	1121081

Notes

[trixie] - rnp <not-affected> (Vulnerable code introduced later)
[bookworm] - rnp <not-affected> (Vulnerable code introduced later)
https://bugzilla.redhat.com/show_bug.cgi?id=2415863
Introduced with: https://github.com/rnpgp/rnp/commit/020c61c4814d29d723b62ee4a2d2719a6b397acf (v0.18.0)
Fixed by: https://github.com/rnpgp/rnp/commit/1a2359d623e4eac8e81e4c24195fb39898f37b40 (v0.18.1)