« Volver al listado

CVE-2025-22865

Estado: AplazadaAlta (7.5)—

Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de denegación de servicio en análisis de claves RSA (panic en ParsePKCS1PrivateKey). AV:N/AC:L/PR:N sin interacción permite explotación remota (T1190) causando DoS (T1499.004: Application Exhaustion).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-22865",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-22865",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-28T14:58:11.060442Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@golang.org",
      "affectedData": [
        {
          "vendor": "Go standard library",
          "product": "crypto/x509",
          "versions": [
            {
              "status": "affected",
              "version": "1.24.0-0",
              "lessThan": "1.24.0-rc.2",
              "versionType": "semver"
            }
          ],
          "packageName": "crypto/x509",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "ParsePKCS1PrivateKey"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-01-28T02:15:29.243",
  "references": [
    {
      "url": "https://go.dev/cl/643098",
      "source": "security@golang.org"
    },
    {
      "url": "https://go.dev/issue/71216",
      "source": "security@golang.org"
    },
    {
      "url": "https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ",
      "source": "security@golang.org"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2025-3421",
      "source": "security@golang.org"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed."
    },
    {
      "lang": "es",
      "value": "El uso de ParsePKCS1PrivateKey para analizar una clave RSA a la que le faltan los valores CRT provocaría un pánico al verificar que la clave esté bien formada."
    }
  ],
  "lastModified": "2026-06-17T08:50:38.050",
  "sourceIdentifier": "security@golang.org"
}