CVE-2018-25099

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In the CryptX module before 0.062 for Perl, gcm_decrypt_verify() and chacha20poly1305_decrypt_verify() do not verify the tag.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published
Mar 18, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2018

CVE-2018-251005.3The Mojolicious module before 7.66 for Perl may leak cookies in certain situations related to multiple similar cookies for the same domain. CVE-2018-251013.5A vulnerability, which was classified as problematic, has been found in l2c2technologies Koha up to 20180108. This issue affects some unknowCVE-2018-251035.3There exists use-after-free vulnerabilities in lighttpd <= 1.4.50 request parsing which might read from invalid pointers to memory used in tCVE-2018-251044.3A vulnerability was found in CoinGate Plugin up to 1.2.7 on PrestaShop. It has been rated as problematic. Affected by this issue is the funcCVE-2018-251059.8The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in CVE-2018-251066.3A vulnerability, which was classified as critical, has been found in webuidesigning NebulaX Theme up to 5.0 on WordPress. This issue affectsCVE-2018-251077.5The Crypt::Random::Source package before 0.13 for Perl has a fallback to the built-in rand() function, which is not a secure source of randoCVE-2018-251087.5An unauthenticated remote attacker can cause a DoS in the controller due to uncontrolled resource consumption.CVE-2018-251096.4A vulnerability has been found in Nintendo Animal Crossing, Doubutsu no Mori+ and Doubutsu no Mori e+ 1.00/1.01 on GameCube and classified aCVE-2018-251107.5Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in seCVE-2018-251114.4django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.CVE-2018-251127.5An unauthenticated remote attacker may use an uncontrolled resource consumption in the IEC 61131 program of the affected products by creatin