Bug 2411445

Summary:	CVE-2025-58188 bpfman: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-43]
Product:	[Fedora] Fedora	Reporter:	Jon Moroney <jmoroney>
Component:	bpfman	Assignee:	Daniel Mellado <dmellado>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	43	CC:	dmellado, rust-sig
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["f5cd0890-0e9d-43ca-a9a9-2125ff49b065"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2025-11-01 12:12:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2407255

Description Jon Moroney 2025-11-01 00:19:53 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams

Comment 1 Daniel Mellado 2025-11-01 12:12:55 UTC

This CVE does not affect the bpfman package in Fedora.

CVE-2025-58188 is a vulnerability in Go's crypto/x509 package related to DSA public key certificate validation. The Fedora bpfman package does not build, ship, or use any Go code.

Evidence from the spec file (bpfman.spec):

Source0 (line 47): https://github.com/bpfman/bpfman/archive/refs/tags/v0.5.4.tar.gz
- Yes, this source tarball DOES contain Go code (visible in license breakdown line 38: "examples/go-xdp-counter/bpf/xdp_counter.c" and "examples/**/bpf/*.c")
- These are example applications showing how to use bpfman from Go programs
- The tarball also contains clients/gobpfman/ (Go gRPC client library) and go.mod/go.sum

However, NONE of this Go code is built or packaged by the Fedora bpfman RPM:

1. Generated by rust2rpm (line 1) - exclusively Rust packaging
2. BuildRequires (lines 60-70): NO Go toolchain - only cargo-rpm-macros, openssl-devel, zlib, gcc, cmake, clang-devel
3. %build section (line 99): Uses %cargo_build (Rust only)
4. %install section (lines 105-119): Only installs three Rust binaries from ./target/release/:
   - bpfman
   - bpfman-ns
   - bpfman-rpc
5. %files section (lines 130-141): Only packages the three Rust binaries above - no examples/, no clients/, no Go code