{"id":"EUVD-2025-203279","enisaUuid":"0dbf7907-2c46-306b-bd15-72f94d592711","description":"In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.","datePublished":"Dec 14, 2025, 4:35:24 AM","dateUpdated":"Dec 15, 2025, 9:29:01 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","references":"https://gitlab.com/sequoia-pgp/sequoia/-/commit/b59886e5e7bdf7169ed330f309a6633d131776e5\nhttps://bugs.debian.org/1122582\nhttps://gitlab.com/sequoia-pgp/sequoia/-/blob/b59886e5e7bdf7169ed330f309a6633d131776e5/openpgp/NEWS#L7-L26\n","aliases":"CVE-2025-67897\nGHSA-v6x3-9r38-r27q\n","assigner":"mitre","epss":0.35,"enisaIdProduct":[{"id":"abfc9b04-cfad-358b-ba00-452ee02022cf","product":{"name":"sequoia","vendor":{"name":"sequoia-pgp"}},"product_version":"0 \u003c2.1.0"}],"enisaIdVendor":[{"id":"b09122b5-e4f0-3254-9371-7d1316159a73","vendor":{"name":"sequoia-pgp"}}],"enisaIdVulnerability":[{"id":"ce1bd241-795f-32c7-b310-c970942433a9","vulnerability":{"id":"CVE-2025-67897","description":"In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.","datePublished":"Dec 14, 2025, 4:35:24 AM","dateUpdated":"Dec 15, 2025, 9:29:01 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","references":"https://gitlab.com/sequoia-pgp/sequoia/-/commit/b59886e5e7bdf7169ed330f309a6633d131776e5\nhttps://bugs.debian.org/1122582\nhttps://gitlab.com/sequoia-pgp/sequoia/-/blob/b59886e5e7bdf7169ed330f309a6633d131776e5/openpgp/NEWS#L7-L26\n","enisa_id":"EUVD-2025-203279\n","assigner":"mitre","epss":0.35,"dataProcessed":"Nov 6, 2026, 7:21:35 AM","vulnerabilityProduct":[{"id":"8ee21822-d890-3c4b-8c69-5911a308d909","product":{"name":"sequoia","vendor":{"name":"sequoia-pgp"}},"product_version":"0 \u003c2.1.0"}],"vulnerabilityVendor":[{"id":"23608927-0988-32af-aecd-9c09b0ab98e9","vendor":{"name":"sequoia-pgp"}}]}},{"id":"dfd9439d-b13e-3d99-9dd4-ea57c5e28ad1","vulnerability":{"id":"GHSA-v6x3-9r38-r27q","description":"Sequoia PGP has Subtraction Overflow when aes_key_unwrap function is provided ciphertext that is too short","datePublished":"Dec 14, 2025, 6:30:24 AM","dateUpdated":"Dec 16, 2025, 7:30:41 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-67897\nhttps://bugs.debian.org/1122582\nhttps://gitlab.com/sequoia-pgp/sequoia\nhttps://gitlab.com/sequoia-pgp/sequoia/-/blob/b59886e5e7bdf7169ed330f309a6633d131776e5/openpgp/NEWS#L7-L26\nhttps://gitlab.com/sequoia-pgp/sequoia/-/commit/b59886e5e7bdf7169ed330f309a6633d131776e5\nhttps://rustsec.org/advisories/RUSTSEC-2025-0136.html\n","enisa_id":"EUVD-2025-203279\n","aliases":"GHSA-v6x3-9r38-r27q\nCVE-2025-67897\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"2b227f51-f277-317c-8c46-447250f78a25","advisory":{"id":"msrc_CVE-2025-67897","description":"In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.","datePublished":"Dec 2, 2025, 12:00:00 AM","dateUpdated":"Jan 20, 2026, 2:38:32 PM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-67897.json\n","aliases":"CVE-2025-67897\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"11b6bb9e-d58e-382e-ae98-f49a5384e8c1","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"7acc5184-eaab-3684-bd0e-164bebee6321","product":{"name":"kata-containers-cc","vendor":{"name":"Microsoft"}}},{"id":"9b58d194-60c5-3e6c-94f4-92705a2254fd","product":{"name":"azl3 kata-containers-cc 3.15.0.aks0-5","vendor":{"name":"Microsoft"}}},{"id":"ac43015e-a8aa-31e5-b963-671c325092b1","product":{"name":"3.0","vendor":{"name":"Wind River"}}}]}}]}