تخطَّ إلى المحتوى
QuenchWorks

VEXcosmian-kms

cosmian-kms

1 بيان, صدرت في .كل بيان نتيجةٌ من الماسح غير قابلة للاستغلال في هذه الصورة، مع السبب.

الصورةOpenVEX JSON

@id https://quench-works.com/vex/cosmian-kms/2026-10-13

  1. CVE-2025-4432

    غير متأثر · الشيفرة المعرّضة خارج مسار التنفيذ
    • ring 0.16.20

    CVE-2025-4432 (RUSTSEC-2025-0009) is a panic in ring's AES functions (AES-GCM / QUIC header protection counter arithmetic) when overflow checks are on. Cosmian KMS 5.27.0 links ring 0.16.20 only through scratchstack-aws-signature 0.10.6 (Cargo.lock at tag 5.27.0: it is the only package listing ring 0.16.20; 5.27.1 and 5.28.0 carry no ring 0.16). Read the source of scratchstack-aws-signature 0.10.6: it imports only ring::hmac (src/hmac.rs:1, HMAC_SHA256) and ring::digest (src/signature.rs:20, SHA256); no ring::aead or AES call exists, grep for aead|aes over its src returned 0 matches. The AES code is therefore never executed. ring 0.16 has no fixed release (fix is 0.17.12). The recipe fails the build if any other crate depends on ring 0.16. Verified 2026-10-13.