CVE-2025-67897: sequoia-pgp sequoia Signed to Unsigned Conversion Error
CVSS: 5.3v3.1MediumDeferred
AliasesUBUNTU-CVE-2025-67897DEBIAN-CVE-2025-67897CGA-5pxq-73pw-5c7qCGA-pxcq-762g-3269GHSA-v6x3-9r38-r27qRUSTSEC-2025-0136
Published 14-12-2025Last modified 15-12-2025
Vulnerability summary
CVE-2025-67897 is a medium (CVSS 5.3) Signed to Unsigned Conversion Error vulnerability in sequoia-pgp sequoia. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.8% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)EPSS score
0.35%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 14-12-2025PublishedVulnerability first disclosed.
- 15-12-2025Last modifiedVulnerability information updated.
Description
In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.
CVSS metrics
7 scores · 7 sources · 1 versionMedium 5.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:HSources7 sources · 4.3–5.3
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · Crates.ioEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LDiffers
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
0.00 pp
From 0.35% on 21-09-2026
21-09-202621-10-2026
EPSS score0.35%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard1 product
- rpm-sequoia< 1.10.0-r1
Crates.Io1 product
- sequoia-openpgp< 2.1.0 | ≥ 0.0.0-0, < 2.1.0
Debian1 product
- rust-sequoia-openpgpAll versions (No fix recorded) | < 2.0.0-2+deb13u1 | < 2.1.0-1
Sequoia-pgp1 product
- sequoia< 2.1.0
Ubuntu1 product
- rust-sequoia-openpgpAll versions (No fix recorded)
Wolfi1 product
- rpm-sequoia< 1.10.0-r1
6 vendors · 6 products
