Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT. https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
This package is NOT affected by CVE-2025-58189. SUMMARY: ======== CVE-2025-58189 affects Go's crypto/tls package. The Fedora bpfman package is built entirely from Rust code and does not contain or link against Go's crypto/tls package. The bpfman.spec file clearly shows this is a Rust package: 1. Generated by rust2rpm (Fedora's Rust packaging tool) 2. BuildRequires: cargo-rpm-macros (not golang build tools) 3. Build uses Cargo (Rust's build system): - %cargo_prep, %cargo_build, %cargo_test - Sources include Rust vendor tarball - Binaries installed from ./target/release/ (Rust's output directory) 4. Patches only Rust files (.rs files and Cargo.toml) 5. Packages three Rust-compiled binaries: - bpfman, bpfman-ns, bpfman-rpc NOTE: The upstream repository contains some Go code in examples/ and clients/ directories, but these are NOT included in the Fedora RPM package. CONCLUSION: =========== Pure Rust package. CVE-2025-58189 does not apply. Closing as NOTABUG.