SB2025101722 - Fedora EPEL 10.2 update for mbedtls

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025101722

SB2025101722 - Fedora EPEL 10.2 update for mbedtls

Published: October 17, 2025

Security Bulletin ID SB2025101722
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Covert Timing Channel (CVE-ID: CVE-2025-54764)

The vulnerability allows a remote attacker to decrypt data.

The vulnerability exists due to side channel in RSA key generation and operations when the following functions are used: mbedtls_rsa_gen_key(), psa_generate_key*(), mbedtls_rsa_complete(), mbedtls_mpi_inv_mod(). An attacker can fully recover the RSA private key.


2) Covert Timing Channel (CVE-ID: CVE-2025-59438)

The vulnerability allows an attacker to perform padding oracle attack.

The vulnerability exists due to padding oracle through timing of cipher error reporting. An attacker can recover plain texts encrypted with CBC-PKCS7 or other symmetric encryption mode using padding when it is decrypted through the PSA API.


Remediation

Install update from vendor's website.

References