CVE-2022-50237 - Vulnerability Details - OpenCVE

The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://crates.io/crates/ed25519-dalek
https://github.com/MystenLabs/ed25519-unsafe-libs
https://nvd.nist.gov/vuln/detail/CVE-2022-50237
https://rustsec.org/advisories/RUSTSEC-2022-0093.html
https://www.cve.org/CVERecord?id=CVE-2022-50237

History

Tue, 29 Jul 2025 12:30:00 +0000

Type	Values Removed	Values Added
Title		ed25519-dalek: ed25519-dalek: Private Key Extraction Vulnerability
References		https://nvd.nist.gov/vuln/detail/CVE-2022-50237 https://www.cve.org/CVERecord?id=CVE-2022-50237
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 28 Jul 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 28 Jul 2025 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-497
Metrics		cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N'}`

Mon, 28 Jul 2025 02:00:00 +0000

Type	Values Removed	Values Added
Description		The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key.
References		https://crates.io/crates/ed25519-dalek https://github.com/MystenLabs/ed25519-unsafe-libs https://rustsec.org/advisories/RUSTSEC-2022-0093.html

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2025-07-28T00:00:00.000Z

Updated: 2025-07-28T13:56:12.178Z

Reserved: 2025-07-28T00:00:00.000Z

Link: CVE-2022-50237

Vulnrichment

Updated: 2025-07-28T13:56:07.593Z

NVD

Status : Awaiting Analysis

Published: 2025-07-28T02:15:24.540

Modified: 2025-07-29T14:14:29.590

Link: CVE-2022-50237

Redhat

Severity : Moderate

Publid Date: 2025-07-28T00:00:00Z

Links: CVE-2022-50237 - Bugzilla

{"bugzilla": {"description": "ed25519-dalek: ed25519-dalek: Private Key Extraction Vulnerability", "id": "2383801", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383801"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-497", "details": ["A flaw was found in ed25519-dalek. The Keypair implementation allows an attacker to compute a private key by observing signatures generated with corresponding public keys. This public key signing function oracle attack does not require authentication. An unauthenticated attacker can extract the private key by observing repeated signatures. This compromise of the key can result in unauthorized data signing."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2022-50237", "package_state": [{"cpe": "cpe:/a:redhat:logging:6", "fix_state": "Not affected", "package_name": "openshift-logging/cluster-logging-operator-bundle", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:logging:6", "fix_state": "Not affected", "package_name": "openshift-logging/cluster-logging-rhel9-operator", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:logging:6", "fix_state": "Not affected", "package_name": "openshift-logging/eventrouter-rhel9", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:logging:6", "fix_state": "Not affected", "package_name": "openshift-logging/log-file-metric-exporter-rhel9", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:logging:6", "fix_state": "Not affected", "package_name": "openshift-logging/vector-rhel9", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "rust-sequoia-sq", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "rust-sequoia-sqv", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "trustee-guest-components", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "trustee-guest-components", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "kata-containers", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:trusted_artifact_signer:1", "fix_state": "Not affected", "package_name": "rhtas/tuffer-rhel9", "product_name": "Red Hat Trusted Artifact Signer"}, {"cpe": "cpe:/a:redhat:trusted_artifact_signer:1", "fix_state": "Not affected", "package_name": "rhtas/tuftool-rhel9", "product_name": "Red Hat Trusted Artifact Signer"}, {"cpe": "cpe:/a:redhat:trusted_profile_analyzer:2", "fix_state": "Not affected", "package_name": "rhtpa/rhtpa-trustification-service-rhel9", "product_name": "Red Hat Trusted Profile Analyzer"}], "public_date": "2025-07-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-50237\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-50237\nhttps://crates.io/crates/ed25519-dalek\nhttps://github.com/MystenLabs/ed25519-unsafe-libs\nhttps://rustsec.org/advisories/RUSTSEC-2022-0093.html"], "threat_severity": "Moderate"}