[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <2f8f64a2-118d-458e-9f1a-182d4d88ad17@isc.org>
Date: Wed, 28 May 2025 19:34:09 +0300
From: Andrei Pavel <andrei@....org>
To: oss-security@...ts.openwall.com
Cc: security-officer@....org
Subject: ISC has disclosed three vulnerabilities in Kea (CVE-2025-32801,
CVE-2025-32802, CVE-2025-32803)
On 28 May 2025 we (Internet Systems Consortium) disclosed three
vulnerabilities affecting our Kea software:
- CVE-2025-32801: Loading a malicious hook library can lead to
local privilege escalation https://kb.isc.org/docs/cve-2025-32801
- CVE-2025-32802: Insecure handling of file paths allows multiple
local attacks https://kb.isc.org/docs/cve-2025-32802
- CVE-2025-32803: Insecure file permissions can result in
confidential information leakage https://kb.isc.org/docs/cve-2025-32803
New versions of Kea are available from https://www.isc.org/downloads
- https://downloads.isc.org/isc/kea/2.4.2/
- https://downloads.isc.org/isc/kea/2.6.3/
- https://downloads.isc.org/isc/kea/2.7.9/
With the public announcement of these vulnerabilities, the embargo
period is ended and any updated software packages that have been
prepared may be released.
Download attachment "OpenPGP_0x0F4B060F8E683241.asc" of type "application/pgp-keys" (645 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (237 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
