CVE-2025-40912 - Vulnerability Details - OpenCVE

CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode. CryptX embeds the tomcrypt library. The versions of that library in CryptX before 0.065 may be susceptible to CVE-2019-17362.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://github.com/libtom/libtomcrypt/issues/507

History

Wed, 11 Jun 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 11 Jun 2025 18:00:00 +0000

Type	Values Removed	Values Added
Description		CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode. CryptX embeds the tomcrypt library. The versions of that library in CryptX before 0.065 may be susceptible to CVE-2019-17362.
Title		CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode
Weaknesses		CWE-1395
References		https://github.com/libtom/libtomcrypt/issues/507

MITRE

Status: PUBLISHED

Assigner: CPANSec

Published: 2025-06-11T17:48:39.344Z

Updated: 2025-06-11T18:44:15.223Z

Reserved: 2025-04-16T09:05:34.361Z

Link: CVE-2025-40912

Vulnrichment

Updated: 2025-06-11T18:44:01.081Z

NVD

Status : Awaiting Analysis

Published: 2025-06-11T18:15:25.550

Modified: 2025-06-12T16:06:20.180

Link: CVE-2025-40912

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-40912", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2025-04-16T09:05:34.361Z", "datePublished": "2025-06-11T17:48:39.344Z", "dateUpdated": "2025-06-11T18:44:15.223Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "CryptX", "product": "CryptX", "programFiles": ["src/ltc/pk/asn1/der/utf8/der_decode_utf8_string.c"], "repo": "https://github.com/DCIT/perl-CryptX", "vendor": "MIK", "versions": [{"lessThan": "0.065", "status": "affected", "version": "0.002", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode.</div><div>CryptX embeds the tomcrypt library. The versions of that library in CryptX before 0.065 may be susceptible to CVE-2019-17362.</div>"}], "value": "CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode.\n\nCryptX embeds the tomcrypt library. The versions of that library in CryptX before 0.065 may be susceptible to CVE-2019-17362."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1395", "description": "CWE-1395 Dependency on Vulnerable Third-Party Component", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2025-06-11T17:48:39.344Z"}, "references": [{"url": "https://github.com/libtom/libtomcrypt/issues/507"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Users should update to version 0.065 or later."}], "value": "Users should update to version 0.065 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-06-11T18:43:47.110889Z", "id": "CVE-2025-40912", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-11T18:44:15.223Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-40912", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-11T18:43:47.110889Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-11T18:44:01.081Z"}}], "cna": {"title": "CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/DCIT/perl-CryptX", "vendor": "MIK", "product": "CryptX", "versions": [{"status": "affected", "version": "0.002", "lessThan": "0.065", "versionType": "custom"}], "packageName": "CryptX", "programFiles": ["src/ltc/pk/asn1/der/utf8/der_decode_utf8_string.c"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Users should update to version 0.065 or later.", "supportingMedia": [{"type": "text/html", "value": "Users should update to version 0.065 or later.", "base64": false}]}], "references": [{"url": "https://github.com/libtom/libtomcrypt/issues/507"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode.\n\nCryptX embeds the tomcrypt library. The versions of that library in CryptX before 0.065 may be susceptible to CVE-2019-17362.", "supportingMedia": [{"type": "text/html", "value": "<div>CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode.</div><div>CryptX embeds the tomcrypt library. The versions of that library in CryptX before 0.065 may be susceptible to CVE-2019-17362.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1395", "description": "CWE-1395 Dependency on Vulnerable Third-Party Component"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2025-06-11T17:48:39.344Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40912", "state": "PUBLISHED", "dateUpdated": "2025-06-11T18:44:15.223Z", "dateReserved": "2025-04-16T09:05:34.361Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2025-06-11T17:48:39.344Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.1"}