CVE-2025-59339CWE-325

The Bastion ttyrec files are not signed after encryption by the osh-encrypt-rsync script

Medium · published September 17, 2025

CVSS v3.1
4.4
EPSS
0%
Percentile
0.8
In the wild
Unconfirmed
What it is

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. Session-recording ttyrec files, may be handled by the provided osh-encrypt-rsync script that is a helper to rotate, encrypt, sign, copy, and optionally move them to a remote storage periodically, if configured to. When running, the script properly rotates and encrypts the files using the provided GPG key(s), but silently fails to sign them, even if asked to.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00100 · 0.8th percentile
Weakness
CWE-325 · Missing Cryptographic Step
Published
2025-09-17T17:50Z
EPSS history
Timeline
  • 17 SEP 17:50Z
    The Bastion ttyrec files are not signed after encryption by the osh-encrypt-rsync script
    cvelistv5