Debian Rnp vulnerabilities

CVE-2025-13470 [HIGH] CVE-2025-13470: rnp - In RNP version 0.18.0 a refactoring regression causes the symmetric session key... In RNP version 0.18.0 a refactoring regression causes the symmetric session key used for Public-Key Encrypted Session Key (PKESK) packets to be left uninitialized except for zeroing, resulting in it always being an all-zero byte array. Any data encrypted using public-key encryption in this release can be decrypted trivially by supplying an all-zero session key, fully co

CVE-2023-29480 [HIGH] CVE-2023-29480: rnp - Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use. Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use. Scope: local bookworm: resolved (fixed in 0.16.3-1) forky: resolved (fixed in 0.16.3-1) sid: resolved (fixed in 0.16.3-1) trixie: resolved (fixed in 0.16.3-1)

CVE-2023-29479 [MEDIUM] CVE-2023-29479: rnp - Ribose RNP before 0.16.3 may hang when the input is malformed. Ribose RNP before 0.16.3 may hang when the input is malformed. Scope: local bookworm: resolved (fixed in 0.16.3-1) forky: resolved (fixed in 0.16.3-1) sid: resolved (fixed in 0.16.3-1) trixie: resolved (fixed in 0.16.3-1)

CVE-2021-33589 [HIGH] CVE-2021-33589: rnp - Ribose RNP before 0.15.1 does not implement a required step in a cryptographic a... Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of the algorithm. Scope: local bookworm: resolved (fixed in 0.15.1-1) forky: resolved (fixed in 0.15.1-1) sid: resolved (fixed in 0.15.1-1) trixie: resolved (fixed in 0.15.1-1)