Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1271189

Bug#1121204: wolfssl: CVE-2025-12888

Show all headers | View raw

Source: wolfssl
Version: 5.8.2-1.2
Severity: important
Tags: security upstream
Forwarded: https://github.com/wolfSSL/wolfssl/pull/9275
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for wolfssl.

CVE-2025-12888[0]:
| Vulnerability in X25519 constant-time cryptographic implementations
| due to timing side channels introduced by compiler optimizations and
| CPU architecture limitations, specifically with the Xtensa-based
| ESP32 chips. If targeting Xtensa it is recommended to use the low
| memory implementations of X25519, which is now turned on as the
| default for Xtensa.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-12888
    https://www.cve.org/CVERecord?id=CVE-2025-12888
[1] https://github.com/wolfSSL/wolfssl/pull/9275
[2] https://github.com/wolfSSL/wolfssl/commit/c161cbd9f3fa1247382bb5b6269c7379222cabf5

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Back to linux.debian.bugs.dist | Previous | Next | Find similar | Unroll thread

Thread

Bug#1121204: wolfssl: CVE-2025-12888 Salvatore Bonaccorso <carnil@debian.org> - 2025-11-22 16:40 +0100

csiph-web