Bug 2408126

Summary: CVE-2025-58189 bpfman: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-43]
Product: [Fedora] Fedora Reporter: Jon Moroney <jmoroney>
Component: bpfmanAssignee: Daniel Mellado <dmellado>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 43CC: dmellado, rust-sig
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["3315d28f-56bc-48ea-9391-3ff13568ea24"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2025-10-31 07:54:16 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2407260    

Description Jon Moroney 2025-10-30 19:45:07 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Comment 1 Daniel Mellado 2025-10-31 07:54:16 UTC 
This package is NOT affected by CVE-2025-58189.

SUMMARY:
========
CVE-2025-58189 affects Go's crypto/tls package. The Fedora bpfman package is 
built entirely from Rust code and does not contain or link against Go's 
crypto/tls package.

The bpfman.spec file clearly shows this is a Rust package:

1. Generated by rust2rpm (Fedora's Rust packaging tool)

2. BuildRequires: cargo-rpm-macros (not golang build tools)

3. Build uses Cargo (Rust's build system):
   - %cargo_prep, %cargo_build, %cargo_test
   - Sources include Rust vendor tarball
   - Binaries installed from ./target/release/ (Rust's output directory)

4. Patches only Rust files (.rs files and Cargo.toml)

5. Packages three Rust-compiled binaries:
   - bpfman, bpfman-ns, bpfman-rpc

NOTE: The upstream repository contains some Go code in examples/ and 
clients/ directories, but these are NOT included in the Fedora RPM package.

CONCLUSION:
===========
Pure Rust package. CVE-2025-58189 does not apply.

Closing as NOTABUG.