{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/vex/2025/cve-2025-14505-els_os-almalinux9_2esu.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-04-03T16:45:06Z",
      "generator": {
        "date": "2026-04-03T16:45:06Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2025-14505-ELS_OS-ALMALINUX9.2ESU",
      "initial_release_date": "2025-01-01T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-01-01T00:00:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-02T09:01:32Z",
          "number": "2",
          "summary": "Official Publication"
        },
        {
          "date": "2026-04-03T16:45:06Z",
          "number": "3",
          "summary": "Update document"
        }
      ],
      "status": "final",
      "version": "3"
    },
    "title": "Security update on CVE-2025-14505"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "AlmaLinux 9.2",
                "product": {
                  "name": "AlmaLinux 9.2",
                  "product_id": "AlmaLinux-9.2",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:almalinux:almalinux:9.2:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "AlmaLinux"
          }
        ],
        "category": "vendor",
        "name": "AlmaLinux OS Foundation"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libicu-0:67.1-9.el9.tuxcare.els1.i686",
                "product": {
                  "name": "libicu-0:67.1-9.el9.tuxcare.els1.i686",
                  "product_id": "libicu-0:67.1-9.el9.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/libicu@67.1-9.el9.tuxcare.els1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libicu-devel-0:67.1-9.el9.tuxcare.els1.i686",
                "product": {
                  "name": "libicu-devel-0:67.1-9.el9.tuxcare.els1.i686",
                  "product_id": "libicu-devel-0:67.1-9.el9.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/libicu-devel@67.1-9.el9.tuxcare.els1?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libicu-0:67.1-9.el9.tuxcare.els1.x86_64",
                "product": {
                  "name": "libicu-0:67.1-9.el9.tuxcare.els1.x86_64",
                  "product_id": "libicu-0:67.1-9.el9.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/libicu@67.1-9.el9.tuxcare.els1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64",
                "product": {
                  "name": "libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64",
                  "product_id": "libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/libicu-devel@67.1-9.el9.tuxcare.els1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "icu-0:67.1-9.el9.tuxcare.els1.x86_64",
                "product": {
                  "name": "icu-0:67.1-9.el9.tuxcare.els1.x86_64",
                  "product_id": "icu-0:67.1-9.el9.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/icu@67.1-9.el9.tuxcare.els1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch",
                "product": {
                  "name": "libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch",
                  "product_id": "libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/libicu-doc@67.1-9.el9.tuxcare.els1?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libicu-0:67.1-9.el9.tuxcare.els1.i686 as a component of AlmaLinux 9.2",
          "product_id": "AlmaLinux-9.2:libicu-0:67.1-9.el9.tuxcare.els1.i686"
        },
        "product_reference": "libicu-0:67.1-9.el9.tuxcare.els1.i686",
        "relates_to_product_reference": "AlmaLinux-9.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libicu-0:67.1-9.el9.tuxcare.els1.x86_64 as a component of AlmaLinux 9.2",
          "product_id": "AlmaLinux-9.2:libicu-0:67.1-9.el9.tuxcare.els1.x86_64"
        },
        "product_reference": "libicu-0:67.1-9.el9.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch as a component of AlmaLinux 9.2",
          "product_id": "AlmaLinux-9.2:libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch"
        },
        "product_reference": "libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch",
        "relates_to_product_reference": "AlmaLinux-9.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libicu-devel-0:67.1-9.el9.tuxcare.els1.i686 as a component of AlmaLinux 9.2",
          "product_id": "AlmaLinux-9.2:libicu-devel-0:67.1-9.el9.tuxcare.els1.i686"
        },
        "product_reference": "libicu-devel-0:67.1-9.el9.tuxcare.els1.i686",
        "relates_to_product_reference": "AlmaLinux-9.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64 as a component of AlmaLinux 9.2",
          "product_id": "AlmaLinux-9.2:libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64"
        },
        "product_reference": "libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "icu-0:67.1-9.el9.tuxcare.els1.x86_64 as a component of AlmaLinux 9.2",
          "product_id": "AlmaLinux-9.2:icu-0:67.1-9.el9.tuxcare.els1.x86_64"
        },
        "product_reference": "icu-0:67.1-9.el9.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14505",
      "cwe": {
        "id": "CWE-1240",
        "name": "Use of a Cryptographic Primitive with a Risky Implementation"
      },
      "notes": [
        {
          "category": "description",
          "text": "The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as computed based on step 3.2 of  RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 ) has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This happens, because the byte-length of 'k' is incorrectly computed, resulting in its getting truncated during the computation. Legitimate transactions or communications will be broken as a result. Furthermore, due to the nature of the fault, attackers could–under certain conditions–derive the secret key, if they could get their hands on both a faulty signature generated by a vulnerable version of Elliptic and a correct signature for the same inputs.\nThis issue affects all known versions of Elliptic (at the time of writing, versions less than or equal to 6.6.1).",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        },
        {
          "category": "other",
          "text": "TuxCare has assessed that this vulnerability does not impact any currently supported TuxCare products. This evaluation may change as new information becomes available. For additional details regarding this vulnerability and affected products, refer to the provided references.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "AlmaLinux-9.2:icu-0:67.1-9.el9.tuxcare.els1.x86_64",
          "AlmaLinux-9.2:libicu-0:67.1-9.el9.tuxcare.els1.i686",
          "AlmaLinux-9.2:libicu-0:67.1-9.el9.tuxcare.els1.x86_64",
          "AlmaLinux-9.2:libicu-devel-0:67.1-9.el9.tuxcare.els1.i686",
          "AlmaLinux-9.2:libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64",
          "AlmaLinux-9.2:libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2025-14505"
        }
      ],
      "release_date": "2026-01-08T21:05:00Z",
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AlmaLinux-9.2:icu-0:67.1-9.el9.tuxcare.els1.x86_64",
            "AlmaLinux-9.2:libicu-0:67.1-9.el9.tuxcare.els1.i686",
            "AlmaLinux-9.2:libicu-0:67.1-9.el9.tuxcare.els1.x86_64",
            "AlmaLinux-9.2:libicu-devel-0:67.1-9.el9.tuxcare.els1.i686",
            "AlmaLinux-9.2:libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64",
            "AlmaLinux-9.2:libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        },
        {
          "category": "impact",
          "details": "moderate",
          "product_ids": [
            "AlmaLinux-9.2:icu-0:67.1-9.el9.tuxcare.els1.x86_64",
            "AlmaLinux-9.2:libicu-0:67.1-9.el9.tuxcare.els1.i686",
            "AlmaLinux-9.2:libicu-0:67.1-9.el9.tuxcare.els1.x86_64",
            "AlmaLinux-9.2:libicu-devel-0:67.1-9.el9.tuxcare.els1.i686",
            "AlmaLinux-9.2:libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64",
            "AlmaLinux-9.2:libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch"
          ]
        }
      ]
    }
  ]
}