ovh the-bastion up to 3.21.x missing cryptographic step

Summaryinfo

A vulnerability has been found in ovh the-bastion up to 3.21.x and classified as problematic. Impacted is an unknown function. Performing a manipulation results in missing cryptographic step. This vulnerability is reported as CVE-2025-59339. The attack requires a local approach. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in ovh the-bastion up to 3.21.x. This affects an unknown part. The manipulation with an unknown input leads to a missing cryptographic step vulnerability. CWE is classifying the issue as CWE-325. The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm. This is going to have an impact on integrity. The summary by CVE is:

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. Session-recording ttyrec files, may be handled by the provided osh-encrypt-rsync script that is a helper to rotate, encrypt, sign, copy, and optionally move them to a remote storage periodically, if configured to. When running, the script properly rotates and encrypts the files using the provided GPG key(s), but silently fails to sign them, even if asked to.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-59339 since 09/12/2025. The exploitability is told to be easy. Attacking locally is a requirement. Additional levels of successful authentication are required for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1600 according to MITRE ATT&CK.

Upgrading to version 3.22.00 eliminates this vulnerability. Applying the patch 9bc85ec3f4b724f903773ba64909777c4826a13f is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• ovh

Name

• the-bastion

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21

License

• open-source

Website

• Product: https://github.com/ovh/the-bastion/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion