CVE-2025-52473

{"id": "CVE-2025-52473", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2025-07-10T19:15:25.387", "references": [{"url": "https://github.com/open-quantum-safe/liboqs/commit/4215362acbf69b88fe1777c4c052f154e29f9897", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-qq3m-rq9v-jfgm", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Multiple secret-dependent branches have been identified in the reference implementation of the HQC key encapsulation mechanism when it is compiled with Clang for optimization levels above -O0 (-O1, -O2, etc). A proof-of-concept local attack exploits this secret-dependent information to recover the entire secret key. This vulnerability is fixed in 0.14.0."}, {"lang": "es", "value": "liboqs es una librer\u00eda criptogr\u00e1fica en lenguaje C que proporciona implementaciones de algoritmos de criptograf\u00eda poscu\u00e1ntica. Se han identificado m\u00faltiples ramas dependientes de secretos en la implementaci\u00f3n de referencia del mecanismo de encapsulaci\u00f3n de claves HQC al compilarse con Clang para niveles de optimizaci\u00f3n superiores a -O0 (-O1, -O2, etc.). Un ataque local de prueba de concepto explota esta informaci\u00f3n dependiente de secretos para recuperar la clave secreta completa. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 0.14.0."}], "lastModified": "2025-08-22T17:04:49.530", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openquantumsafe:liboqs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8ABA5BA0-A380-42A4-B53A-3EF8E18C1F99", "versionEndExcluding": "0.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}