Hi,

The following vulnerability was published for golang-github-openpubkey-openpubkey.

The details are rather scarce, basically just the CVE description, might
be worth reaching out to upstream for further information

CVE-2025-4658[0]:
| Versions of OpenPubkey library prior to 0.10.0  contained a
| vulnerability that would allow a specially crafted JWS to bypass
| signature verification. As OPKSSH depends on the OpenPubkey library
| for authentication, this vulnerability in OpenPubkey also applies to
| OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass
| OPKSSH authentication.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-4658
https://www.cve.org/CVERecord?id=CVE-2025-4658

Please adjust the affected versions in the BTS as needed.

Am Tue, May 13, 2025 at 11:45:58PM +0200 schrieb Moritz Mühlenhoff:

There's also CVE-2025-3757, which seems to be the same?

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability
that would allow a specially crafted JWS to bypass signature verification.

Cheers,
        Moritz

Hi Moritz,

I think they are different, the following argument on my side:

CVE-2025-4658 is for opkssh and references
https://github.com/openpubkey/opkssh/security/advisories/GHSA-56wx-66px-9j66

while CVE-2025-3757 would be this one for
golang-github-openpubkey-openpubkey and references
https://github.com/openpubkey/openpubkey/security/advisories/GHSA-537f-gxgm-3jjq.

Regards,
Salvatore