UBUNTU-CVE-2025-4658

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2025-4658
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-4658.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2025-4658
Upstream
Published
2025-05-13T17:16:00Z
Modified
2025-10-10T19:49:45.794588Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.

References

Affected packages

Ubuntu:25.10 / opkssh

Package

Name
opkssh
Purl
pkg:deb/ubuntu/opkssh@0.4.0-1?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.4.0-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "golang-github-openpubkey-opkssh-dev",
            "binary_version": "0.4.0-1"
        },
        {
            "binary_name": "opkssh",
            "binary_version": "0.4.0-1"
        }
    ]
}