GHSA-4p46-pwfr-66x6PublishedWithdrawn

Ring: some aes functions may panic when overflow checking is enabled in ring

cve-program · CVE-2025-4432

Published

ring

https://github.com/briansmith/ring

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "0.17.12",
                            "versionType": "semver"
                        }
                    ],
                    "packageName": "ring",
                    "collectionURL": "https://github.com/briansmith/ring",
                    "defaultStatus": "unaffected"
                }

firefox

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "firefox",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

gjs

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "gjs",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

rpm-ostree

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rpm-ostree",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

rust

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rust",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

snpguest

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "snpguest",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

thunderbird

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "thunderbird",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

trustee-guest-components

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "trustee-guest-components",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

firefox

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 6",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "firefox",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/o:redhat:rhel_els:6"
                    ]
                }

thunderbird

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 6",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "thunderbird",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/o:redhat:rhel_els:6"
                    ]
                }

firefox

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 7",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "firefox",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/o:redhat:rhel_els:7"
                    ]
                }

thunderbird

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 7",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "thunderbird",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/o:redhat:rhel_els:7"
                    ]
                }

firefox

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "firefox",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

thunderbird

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "thunderbird",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

firefox

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "firefox",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

firefox:flatpak/firefox

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "firefox:flatpak/firefox",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

gjs

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "gjs",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

polkit

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "polkit",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

rpm-ostree

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rpm-ostree",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

rust

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rust",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

snpguest

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "snpguest",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

thunderbird

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "thunderbird",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

thunderbird:flatpak/thunderbird

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "thunderbird:flatpak/thunderbird",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

trustee-guest-components

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "trustee-guest-components",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

kata-containers

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "kata-containers",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

python3.12-maturin

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Satellite 6",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "python3.12-maturin",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:satellite:6"
                    ]
                }

python-maturin

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Satellite 6",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "python-maturin",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:satellite:6"
                    ]
                }

rhtas/tuffer-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Artifact Signer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtas/tuffer-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_artifact_signer:1"
                    ]
                }

rhtas/tuftool-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Artifact Signer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtas/tuftool-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_artifact_signer:1"
                    ]
                }

rhtpa/rhtpa-trustification-service-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Profile Analyzer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtpa/rhtpa-trustification-service-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_profile_analyzer:1"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2025-14177

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: May 9, 2025, 4:06:33 PM

dateUpdated: Nov 5, 2026, 3:46:38 PM

2 related source bulletins · separate from aliases

msrc_CVE-2025-4432: Ring: some aes functions may panic when overflow checking is enabled in ring

CVE-2025-4432

openSUSE-SU-2025:15135-1: govulncheck-vulndb-0.0.20250515T200012-1.1 on GA media

CVE-2024-52290 · CVE-2024-8063 · CVE-2025-3757 · CVE-2025-3931 · CVE-2025-4432 · CVE-2025-46331 · CVE-2025-4658 · CVE-2025-46721 · CVE-2025-46735 · CVE-2025-46815 · CVE-2025-46816

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2025-4432

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-770

Original publisher date fields

published: 2025-05-09T16:15:25.467

lastModified: 2026-11-05T16:17:18.430

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-4p46-pwfr-66x6

Published

ring

crates.io

SEMVER · introduced 0 → fixed 0.17.12

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-c86p-w88r-qvqr

Withdrawn

ring

crates.io

SEMVER · introduced 0 → fixed 0.17.13

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GO-2025-3678

Published

github.com/briansmith/ring

SEMVER · introduced 0

Original source record · Cite this exact observation · Complete original publisher JSON

osv · RUSTSEC-2025-0009

Published

ring

crates.io

SEMVER · introduced 0.0.0-0 → fixed 0.17.12

Original source record · Cite this exact observation · Complete original publisher JSON