> CVE-2025-22866 [MEDIUM]

« BACK_TO_HOME
PUBLISHED
2025-02-06 17:15
MODIFIED
2025-02-21 18:15
CVSS_SCORE V3
4.0
EPSS (Prob. Exploit)
0.29%
Top 78.4%
DATA SOURCES:
NVD 🔗 2025-10-18 RED HAT 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 OSV 🔗 2026-11-08

> DESCRIPTION

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.

> AFFECTED_PRODUCTS

Red Hat - Red Hat Enterprise Linux 10
Version: 1.24.1
Red Hat - Red Hat Enterprise Linux 10
Version: 1.23.7
Red Hat - Red Hat Enterprise Linux 9
Version: 1.24.1
Red Hat - Red Hat Enterprise Linux 9
Version: 1.23.6
Red Hat - Red Hat Enterprise Linux 9
Version: 0.2.6
Red Hat - Red Hat OpenShift distributed tracing 3.5.2
Red Hat - Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9
Red Hat - Red Hat Ceph Storage 7.1
Red Hat - Red Hat Ceph Storage 7.1
Version: 7
Red Hat - RHOSS-1.36-RHEL-8
Red Hat - Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9
Red Hat - Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
Red Hat - Red Hat OpenShift Service Mesh 2.5 for RHEL 8
Red Hat - HawtIO HawtIO 4.2.0

> CVSS V3 METRICS

CVSS_VECTOR
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

> MÉTRIQUES CVSS DÉTAILLÉES

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Métrique Valeur Interprétation
AV (Vecteur d'Attaque)
Attack Vector
Local (L)
Exploit nécessite un accès local au système
AC (Complexité d'Attaque)
Attack Complexity
Low (L)
Peu de conditions requises pour exploiter
PR (Privilèges Requis)
Privileges Required
None (N)
Aucune authentification requise
UI (Interaction Utilisateur)
User Interaction
None (N)
Aucune interaction utilisateur nécessaire
S (Périmètre)
Scope
Unchanged (U)
Impact reste dans le périmètre du composant compromis
C (Impact Confidentialité)
Confidentiality Impact
Low (L)
Divulgation limitée d'informations
I (Impact Intégrité)
Integrity Impact
None (N)
Aucune modification de données possible
A (Impact Disponibilité)
Availability Impact
None (N)
Aucune interruption de service

> RÉSUMÉ DES IMPACTS

Confidentialité
Low
Divulgation limitée d'informations
Intégrité
None
Aucune modification de données possible
Disponibilité
None
Aucune interruption de service

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: HawtIO 4.2.0 for Red Hat build of Apache Camel 4 Release and security update.
HawtIO 4.2.0 for Red Hat build of Apache Camel 4 GA Release is now available. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and e...
Red Hat Security Advisory: Release of OpenShift Serverless Logic 1.36.0 security update & enhancements
Release of OpenShift Serverless Logic 1.36.0 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gi...
Red Hat Security Advisory: delve and golang security update
An update for delve and golang is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring...
Red Hat Security Advisory: rhc security update
An update for rhc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS)...
Red Hat Security Advisory: RHSA: Submariner 0.18.5 - bug and security update
Submariner 0.18 packages that fix various bugs and add various enhancements that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.11. Red Hat Product Security has ra...
Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.11.7 container updates
Red Hat Advanced Cluster Management for Kubernetes 2.11.7 General Availability release images, with updates to container images and bug fixes. Red Hat Product Security has rated this update as having...
Red Hat Security Advisory: Updated 7.1 container image is now available in the Red Hat Ecosystem Catalog.
Updated rhceph-7.1 container image is now available in the Red Hat Ecosystem Catalog.
Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.5.10
Red Hat OpenShift Service Mesh Containers for 2.5.10 This update has a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is...
Red Hat Security Advisory: delve and golang security update
An update for delve and golang is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...
Red Hat Enhancement Advisory: RHEA: Submariner 0.19.3 - bug fix and enhancement update
Submariner 0.19.3 packages that fix various bugs and add various enhancements that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.12
Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.5.0 release
Red Hat build of OpenTelemetry 3.5.0 has been released
Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.5 security update
Red Hat multicluster engine for Kubernetes v2.10 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this up...
Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.5 security update
Red Hat multicluster engine for Kubernetes v2.11 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this up...
Red Hat Security Advisory: multicluster engine for Kubernetes v2.6.14 security update
Red Hat multicluster engine for Kubernetes v2.6 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this upd...
Red Hat Security Advisory: multicluster engine for Kubernetes v2.9.7 security update
Red Hat multicluster engine for Kubernetes v2.9 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this upd...
Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.10 security update
Red Hat multicluster engine for Kubernetes v2.8 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this upd...
Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.6 security update
Red Hat multicluster engine for Kubernetes v2.10 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this up...
Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.6 security update
Red Hat multicluster engine for Kubernetes v2.11 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this up...
Red Hat Security Advisory: osbuild-composer security update
An update for osbuild-composer is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...
Red Hat Security Advisory: osbuild-composer security update
An update for osbuild-composer is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product...
Red Hat Security Advisory: osbuild-composer security update
An update for osbuild-composer is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Re...
Red Hat Security Advisory: git-lfs security update
An update for git-lfs is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security...
Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.11 security update
Red Hat multicluster engine for Kubernetes v2.8 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this upd...
Red Hat Security Advisory: git-lfs security update
An update for git-lfs is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Pro...
Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update
An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red H...
Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update
An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life...
Red Hat Security Advisory: grafana-pcp security update
An update for grafana-pcp is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Secur...
Red Hat Security Advisory: grafana-pcp security update
An update for grafana-pcp is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat...
Red Hat Security Advisory: grafana security update
An update for grafana is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security...
Red Hat Security Advisory: grafana security update
An update for grafana is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Pro...
Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update
An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life...
Red Hat Security Advisory: Red Hat Web Terminal Operator 1.14.2 release.
Red Hat Web Terminal Operator 1.14.2 has been released.
Red Hat Security Advisory: Red Hat Web Terminal Operator 1.11.3 release.
Red Hat Web Terminal Operator 1.11.3 has been released.
Red Hat Security Advisory: Red Hat Web Terminal Operator 1.13.2 release.
Red Hat Web Terminal Operator 1.13.2 has been released.
Red Hat Security Advisory: git-lfs security update
An update for git-lfs is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Pro...

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Moderate

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

ALIASES:
BIT-golang-2025-22866, GO-2025-3447

> HISTORIQUE DES MODIFICATIONS

Première apparition
06/02/2025 17:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:00
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
📊 ENRICHISSEMENT 18/10/2025 12:25
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Moderate", "severity_scale": null }
📊 ENRICHISSEMENT 18/10/2025 12:25
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 3 Dernière mise à jour: 1 year ago
« BACK_TO_HOME