[<prev] [day] [month] [year] [list]
Message-ID: <74bd30d5-179d-4a2b-9180-6123011813e5@cpansec.org>
Date: Tue, 21 Apr 2026 16:35:57 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2025-15638: Net::Dropbear versions before 0.14 for Perl contains
a vulnerable version of libtomcrypt
========================================================================
CVE-2025-15638 CPAN Security Group
========================================================================
CVE ID: CVE-2025-15638
Distribution: Net-Dropbear
Versions: before 0.14
MetaCPAN: https://metacpan.org/dist/Net-Dropbear
VCS Repo: https://github.com/atrodo/Net-Dropbear
Net::Dropbear versions before 0.14 for Perl contains a vulnerable
version of libtomcrypt
Description
-----------
Net::Dropbear versions before 0.14 for Perl contains a vulnerable
version of libtomcrypt.
Net::Dropbear versions before 0.14 includes versions of Dropbear
2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or
earlier, which is affected by CVE-2016-6129 and CVE-2018-12437.
Problem types
-------------
- CWE-1395 Dependency on Vulnerable Third-Party Component
References
----------
https://www.cve.org/CVERecord?id=CVE-2016-6129
https://www.cve.org/CVERecord?id=CVE-2018-12437
https://metacpan.org/release/ATRODO/Net-Dropbear-0.14/source/dropbear/libtomcrypt/changes
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
