CVE-2025-59534: CryptoLib command Injection vulnerability in initialize_kerberos_keytab_file_login()
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.2, there is a command Injection vulnerability in initializekerberoskeytabfilelogin(). The vulnerability exists because the code directly interpolates user-controlled input into a shell command and executes it via system() without any sanitization or validation. This issue has been patched in version 1.4.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59534?
CVE-2025-59534 is classified with a high severity due to potential command injection vulnerabilities.
How do I fix CVE-2025-59534?
To fix CVE-2025-59534, update CryptoLib to version 1.4.2 or later.
What are the potential impacts of CVE-2025-59534?
The impacts of CVE-2025-59534 include unauthorized command execution which could compromise the integrity of spacecraft communications.
Which versions of CryptoLib are affected by CVE-2025-59534?
CVE-2025-59534 affects all versions of CryptoLib prior to 1.4.2.
Who is responsible for mitigating CVE-2025-59534?
It is the responsibility of users and administrators of CryptoLib to implement the necessary updates and mitigations for CVE-2025-59534.