CVE-2025-40913 - OpenCVE

Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow. Net::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://github.com/advisories/GHSA-j3xv-6967-cv88
https://github.com/libtom/libtommath/pull/546
https://metacpan.org/release/ATRODO/Net-Dropbear-0.16/source/dropbear/libtommath/bn_mp_grow.c
https://www.cve.org/CVERecord?id=CVE-2023-36328

History

Wed, 16 Jul 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 16 Jul 2025 14:15:00 +0000

Type	Values Removed	Values Added
Description		Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow. Net::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.
Title		Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow
Weaknesses		CWE-1395
References		https://github.com/advisories/GHSA-j3xv-6967-cv88 https://github.com/libtom/libtommath/pull/546 https://metacpan.org/release/ATRODO/Net-Dropbear-0.16/source/dropbear/libtommath/bn_mp_grow.c https://www.cve.org/CVERecord?id=CVE-2023-36328

MITRE

Status: PUBLISHED

Assigner: CPANSec

Published: 2025-07-16T14:05:33.899Z

Updated: 2025-07-16T20:50:08.893Z

Reserved: 2025-04-16T09:05:34.361Z

Link: CVE-2025-40913

Vulnrichment

Updated: 2025-07-16T20:50:05.042Z

NVD

Status : Awaiting Analysis

Published: 2025-07-16T14:15:25.237

Modified: 2025-07-16T21:15:27.360

Link: CVE-2025-40913

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-40913", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2025-04-16T09:05:34.361Z", "datePublished": "2025-07-16T14:05:33.899Z", "dateUpdated": "2025-07-16T20:50:08.893Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-Dropbear", "product": "Net::Dropbear", "repo": "https://github.com/atrodo/Net-Dropbear", "vendor": "ATRODO", "versions": [{"lessThanOrEqual": "0.16", "status": "affected", "version": "0.01", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow.</div><div>Net::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.</div>"}], "value": "Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow.\n\nNet::Dropbear\u00a0embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1395", "description": "CWE-1395 Dependency on Vulnerable Third-Party Component", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2025-07-16T14:05:33.899Z"}, "references": [{"url": "https://www.cve.org/CVERecord?id=CVE-2023-36328"}, {"url": "https://github.com/libtom/libtommath/pull/546"}, {"url": "https://github.com/advisories/GHSA-j3xv-6967-cv88"}, {"url": "https://metacpan.org/release/ATRODO/Net-Dropbear-0.16/source/dropbear/libtommath/bn_mp_grow.c"}], "source": {"discovery": "UNKNOWN"}, "title": "Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-07-16T20:49:47.475976Z", "id": "CVE-2025-40913", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-16T20:50:08.893Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-40913", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-16T20:49:47.475976Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-16T20:50:05.042Z"}}], "cna": {"title": "Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/atrodo/Net-Dropbear", "vendor": "ATRODO", "product": "Net::Dropbear", "versions": [{"status": "affected", "version": "0.01", "versionType": "custom", "lessThanOrEqual": "0.16"}], "packageName": "Net-Dropbear", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}], "references": [{"url": "https://www.cve.org/CVERecord?id=CVE-2023-36328"}, {"url": "https://github.com/libtom/libtommath/pull/546"}, {"url": "https://github.com/advisories/GHSA-j3xv-6967-cv88"}, {"url": "https://metacpan.org/release/ATRODO/Net-Dropbear-0.16/source/dropbear/libtommath/bn_mp_grow.c"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow.\n\nNet::Dropbear\u00a0embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.", "supportingMedia": [{"type": "text/html", "value": "<div>Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow.</div><div>Net::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1395", "description": "CWE-1395 Dependency on Vulnerable Third-Party Component"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2025-07-16T14:05:33.899Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40913", "state": "PUBLISHED", "dateUpdated": "2025-07-16T20:50:08.893Z", "dateReserved": "2025-04-16T09:05:34.361Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2025-07-16T14:05:33.899Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.1"}