« Volver al listado

CVE-2025-69277

Estado: AplazadaMedia (4.5)—

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Libsodium — LibsodiumAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-69277",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-69277",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-02T15:59:09.134600Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.4
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "libsodium",
          "product": "libsodium",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "ad3004ec8731730e93fcfbbc824e67eadc1c1bae",
              "versionType": "git"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-12-31T06:15:41.513",
  "references": [
    {
      "url": "https://00f.net/2025/12/30/libsodium-vulnerability/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/jedisct1/libsodium/commit/ad3004ec8731730e93fcfbbc824e67eadc1c1bae",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/pyca/pynacl/commit/96314884d88d1089ff5f336dba61d7abbcddbbf7",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/pyca/pynacl/commit/ecf41f55a3d8f1e10ce89c61c4b4d67f3f4467cf",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/pyca/pynacl/issues/920",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://ianix.com/pub/ed25519-deployment.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://news.ycombinator.com/item?id=46435614",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00004.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-184"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group."
    },
    {
      "lang": "es",
      "value": "libsodium antes de ad3004e, en casos de uso atípicos que involucran cierta criptografía personalizada o datos no confiables para crypto_core_ed25519_is_valid_point, maneja incorrectamente las comprobaciones sobre si un punto de curva elíptica es válido porque a veces permite puntos que no están en el grupo criptográfico principal."
    }
  ],
  "lastModified": "2026-06-17T10:00:25.260",
  "sourceIdentifier": "cve@mitre.org"
}