Threats tagged 'ghsa-r3r8-w3g2-hq7h'

In RNP version 0.18.0, a refactoring regression caused the symmetric session key used for Public-Key Encrypted Session Key (PKESK) packets to be left uninitialized except for zeroing, resulting in an all-zero byte array. This flaw allows any data encrypted with public-key encryption in this release to be decrypted trivially by using an all-zero session key, fully compromising confidentiality. The vulnerability affects only public key encryption (PKESK packets) and not passphrase-based encryption (SKESK packets).