Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT. https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
This CVE does not affect the bpfman package in Fedora. CVE-2025-58185 is a vulnerability in Go's encoding/asn1 package related to DER payload parsing that can cause memory exhaustion. The Fedora bpfman package does not build, ship, or use any Go code. Evidence from the spec file (bpfman.spec): Source0 (line 47): https://github.com/bpfman/bpfman/archive/refs/tags/v0.5.4.tar.gz - Yes, this source tarball DOES contain Go code (visible in license breakdown line 38: "examples/go-xdp-counter/bpf/xdp_counter.c" and "examples/**/bpf/*.c") - These are example applications showing how to use bpfman from Go programs - The tarball also contains clients/gobpfman/ (Go gRPC client library) and go.mod/go.sum However, NONE of this Go code is built or packaged by the Fedora bpfman RPM: 1. Generated by rust2rpm (line 1) - exclusively Rust packaging 2. BuildRequires (lines 60-70): NO Go toolchain - only cargo-rpm-macros, openssl-devel, zlib, gcc, cmake, clang-devel 3. %build section (line 99): Uses %cargo_build (Rust only) 4. %install section (lines 105-119): Only installs three Rust binaries from ./target/release/: - bpfman - bpfman-ns - bpfman-rpc 5. %files section (lines 130-141): Only packages the three Rust binaries above - no examples/, no clients/, no Go code The Go examples and client library exist in the upstream tarball for users who want to write Go applications that interact with bpfman, but they are NOT compiled, installed, or distributed with the Fedora bpfman package.