Bug 2409314

Summary:	CVE-2025-61723 bpfman: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-42]
Product:	[Fedora] Fedora	Reporter:	Jon Moroney <jmoroney>
Component:	bpfman	Assignee:	Daniel Mellado <dmellado>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	42	CC:	dmellado, rust-sig
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["9e11f9fa-e3b3-4c37-a80a-d8516bd3a9d2"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2025-11-01 12:16:38 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2407252

Description Jon Moroney 2025-10-31 20:28:58 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams

Comment 1 Daniel Mellado 2025-11-01 12:16:38 UTC

This CVE does not affect the bpfman package in Fedora.

CVE-2025-61723 is a vulnerability in Go's encoding/pem package related to quadratic complexity when parsing invalid PEM inputs. The Fedora bpfman package does not build, ship, or use any Go code.

Evidence from the spec file (bpfman.spec):

Source0 (line 47): https://github.com/bpfman/bpfman/archive/refs/tags/v0.5.4.tar.gz
- Yes, this source tarball DOES contain Go code (visible in license breakdown line 38: "examples/go-xdp-counter/bpf/xdp_counter.c" and "examples/**/bpf/*.c")
- These are example applications showing how to use bpfman from Go programs
- The tarball also contains clients/gobpfman/ (Go gRPC client library) and go.mod/go.sum

However, NONE of this Go code is built or packaged by the Fedora bpfman RPM:

1. Generated by rust2rpm (line 1) - exclusively Rust packaging
2. BuildRequires (lines 60-70): NO Go toolchain - only cargo-rpm-macros, openssl-devel, zlib, gcc, cmake, clang-devel
3. %build section (line 99): Uses %cargo_build (Rust only)
4. %install section (lines 105-119): Only installs three Rust binaries from ./target/release/:
   - bpfman
   - bpfman-ns
   - bpfman-rpc
5. %files section (lines 130-141): Only packages the three Rust binaries above - no examples/, no clients/, no Go code

The Go examples and client library exist in the upstream tarball for users who want to write Go applications that interact with bpfman, but they are NOT compiled, installed, or distributed with the Fedora bpfman package.