Ribose Rnp vulnerabilities

CVE-2025-13470 [HIGH] CWE-330 CVE-2025-13470: In RNP version 0.18.0 a refactoring regression causes the symmetric session key used for Public-Key In RNP version 0.18.0 a refactoring regression causes the symmetric session key used for Public-Key Encrypted Session Key (PKESK) packets to be left uninitialized except for zeroing, resulting in it always being an all-zero byte array. Any data encrypted using public-key encryption in this release can be decrypted trivially by supplying an all-zero s

CVE-2023-29480 [HIGH] CWE-312 CVE-2023-29480: Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use. Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.

CVE-2023-29479 [MEDIUM] CWE-400 CVE-2023-29479: Ribose RNP before 0.16.3 may hang when the input is malformed. Ribose RNP before 0.16.3 may hang when the input is malformed.

CVE-2021-33589 [HIGH] CWE-522 CVE-2021-33589: Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of the algorithm.