Vulnerabilities

TI-2025-12314 CVE-2025-13470 · GHSA-r3r8-w3g2-hq7h

RNP 0.18.0 Vulnerable PKESK session keys

MEDIUM 40

In RNP version 0.18.0 a refactoring regression causes the symmetric session key used for Public-Key Encrypted Session Key (PKESK) packets to be left uninitialized except for zeroing, resulting in it always being an all-z…

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00325 Published 2025-11-21 No fix listed CWE-330

TI-2023-13854 CVE-2023-29480 · GHSA-vrmf-9x5h-2hr7

Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.

LOW 39

Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00413 Published 2023-04-24 No fix listed CWE-312

TI-2023-13853 CVE-2023-29479 · GHSA-rr9h-qqwq-gm72

Ribose RNP before 0.16.3 may hang when the input is malformed.

LOW 32

Ribose RNP before 0.16.3 may hang when the input is malformed.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00901 Published 2023-04-24 Partial fix CWE-770

TI-2021-12972 CVE-2021-33589 · GHSA-85rv-559q-9c4r

Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm…

LOW 33

Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of the algorithm.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00492 Published 2023-04-21 No fix listed CWE-522

Vulnerabilities

Filters

RNP 0.18.0 Vulnerable PKESK session keys

Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.

Ribose RNP before 0.16.3 may hang when the input is malformed.

Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm…