{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/centos-stream8els/vex/2025/cve-2025-22866-els_os-centos-stream8els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-09-18T20:31:37Z",
      "generator": {
        "date": "2026-09-18T20:31:37Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2025-22866-ELS_OS-CENTOS-STREAM8ELS",
      "initial_release_date": "2025-02-06T17:15:00Z",
      "revision_history": [
        {
          "date": "2025-02-06T17:15:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-18T16:48:08Z",
          "number": "2",
          "summary": "Official Publication"
        },
        {
          "date": "2026-09-18T20:31:37Z",
          "number": "3",
          "summary": "Update document"
        }
      ],
      "status": "final",
      "version": "3"
    },
    "title": "Security update on CVE-2025-22866"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Community Enterprise Operating System 8",
                "product": {
                  "name": "Community Enterprise Operating System 8",
                  "product_id": "CentOS-Stream-8",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:centos:centos:8:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Community Enterprise Operating System"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "pam-devel-0:1.3.1-33.el8.i686",
                "product": {
                  "name": "pam-devel-0:1.3.1-33.el8.i686",
                  "product_id": "pam-devel-0:1.3.1-33.el8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/centos/pam-devel@1.3.1-33.el8?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pam-0:1.3.1-33.el8.i686",
                "product": {
                  "name": "pam-0:1.3.1-33.el8.i686",
                  "product_id": "pam-0:1.3.1-33.el8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/centos/pam@1.3.1-33.el8?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "pam-devel-0:1.3.1-33.el8.x86_64",
                "product": {
                  "name": "pam-devel-0:1.3.1-33.el8.x86_64",
                  "product_id": "pam-devel-0:1.3.1-33.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/centos/pam-devel@1.3.1-33.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pam-0:1.3.1-33.el8.x86_64",
                "product": {
                  "name": "pam-0:1.3.1-33.el8.x86_64",
                  "product_id": "pam-0:1.3.1-33.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/centos/pam@1.3.1-33.el8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "pam-devel-0:1.3.1-33.el8.tuxcare.els1.i686",
                "product": {
                  "name": "pam-devel-0:1.3.1-33.el8.tuxcare.els1.i686",
                  "product_id": "pam-devel-0:1.3.1-33.el8.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/pam-devel@1.3.1-33.el8.tuxcare.els1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pam-devel-0:1.3.1-33.el8.tuxcare.els2.i686",
                "product": {
                  "name": "pam-devel-0:1.3.1-33.el8.tuxcare.els2.i686",
                  "product_id": "pam-devel-0:1.3.1-33.el8.tuxcare.els2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/pam-devel@1.3.1-33.el8.tuxcare.els2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pam-0:1.3.1-33.el8.tuxcare.els1.i686",
                "product": {
                  "name": "pam-0:1.3.1-33.el8.tuxcare.els1.i686",
                  "product_id": "pam-0:1.3.1-33.el8.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/pam@1.3.1-33.el8.tuxcare.els1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pam-0:1.3.1-33.el8.tuxcare.els2.i686",
                "product": {
                  "name": "pam-0:1.3.1-33.el8.tuxcare.els2.i686",
                  "product_id": "pam-0:1.3.1-33.el8.tuxcare.els2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/pam@1.3.1-33.el8.tuxcare.els2?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "pam-devel-0:1.3.1-33.el8.tuxcare.els1.x86_64",
                "product": {
                  "name": "pam-devel-0:1.3.1-33.el8.tuxcare.els1.x86_64",
                  "product_id": "pam-devel-0:1.3.1-33.el8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/pam-devel@1.3.1-33.el8.tuxcare.els1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pam-devel-0:1.3.1-33.el8.tuxcare.els2.x86_64",
                "product": {
                  "name": "pam-devel-0:1.3.1-33.el8.tuxcare.els2.x86_64",
                  "product_id": "pam-devel-0:1.3.1-33.el8.tuxcare.els2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/pam-devel@1.3.1-33.el8.tuxcare.els2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pam-0:1.3.1-33.el8.tuxcare.els1.x86_64",
                "product": {
                  "name": "pam-0:1.3.1-33.el8.tuxcare.els1.x86_64",
                  "product_id": "pam-0:1.3.1-33.el8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/pam@1.3.1-33.el8.tuxcare.els1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pam-0:1.3.1-33.el8.tuxcare.els2.x86_64",
                "product": {
                  "name": "pam-0:1.3.1-33.el8.tuxcare.els2.x86_64",
                  "product_id": "pam-0:1.3.1-33.el8.tuxcare.els2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/pam@1.3.1-33.el8.tuxcare.els2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pam-devel-0:1.3.1-33.el8.tuxcare.els1.i686 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.tuxcare.els1.i686"
        },
        "product_reference": "pam-devel-0:1.3.1-33.el8.tuxcare.els1.i686",
        "relates_to_product_reference": "CentOS-Stream-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pam-devel-0:1.3.1-33.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.tuxcare.els1.x86_64"
        },
        "product_reference": "pam-devel-0:1.3.1-33.el8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "CentOS-Stream-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pam-devel-0:1.3.1-33.el8.tuxcare.els2.i686 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.tuxcare.els2.i686"
        },
        "product_reference": "pam-devel-0:1.3.1-33.el8.tuxcare.els2.i686",
        "relates_to_product_reference": "CentOS-Stream-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pam-devel-0:1.3.1-33.el8.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.tuxcare.els2.x86_64"
        },
        "product_reference": "pam-devel-0:1.3.1-33.el8.tuxcare.els2.x86_64",
        "relates_to_product_reference": "CentOS-Stream-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pam-0:1.3.1-33.el8.tuxcare.els1.i686 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-Stream-8:pam-0:1.3.1-33.el8.tuxcare.els1.i686"
        },
        "product_reference": "pam-0:1.3.1-33.el8.tuxcare.els1.i686",
        "relates_to_product_reference": "CentOS-Stream-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pam-0:1.3.1-33.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-Stream-8:pam-0:1.3.1-33.el8.tuxcare.els1.x86_64"
        },
        "product_reference": "pam-0:1.3.1-33.el8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "CentOS-Stream-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pam-0:1.3.1-33.el8.tuxcare.els2.i686 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-Stream-8:pam-0:1.3.1-33.el8.tuxcare.els2.i686"
        },
        "product_reference": "pam-0:1.3.1-33.el8.tuxcare.els2.i686",
        "relates_to_product_reference": "CentOS-Stream-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pam-0:1.3.1-33.el8.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-Stream-8:pam-0:1.3.1-33.el8.tuxcare.els2.x86_64"
        },
        "product_reference": "pam-0:1.3.1-33.el8.tuxcare.els2.x86_64",
        "relates_to_product_reference": "CentOS-Stream-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pam-devel-0:1.3.1-33.el8.i686 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.i686"
        },
        "product_reference": "pam-devel-0:1.3.1-33.el8.i686",
        "relates_to_product_reference": "CentOS-Stream-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pam-devel-0:1.3.1-33.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.x86_64"
        },
        "product_reference": "pam-devel-0:1.3.1-33.el8.x86_64",
        "relates_to_product_reference": "CentOS-Stream-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pam-0:1.3.1-33.el8.i686 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-Stream-8:pam-0:1.3.1-33.el8.i686"
        },
        "product_reference": "pam-0:1.3.1-33.el8.i686",
        "relates_to_product_reference": "CentOS-Stream-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pam-0:1.3.1-33.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-Stream-8:pam-0:1.3.1-33.el8.x86_64"
        },
        "product_reference": "pam-0:1.3.1-33.el8.x86_64",
        "relates_to_product_reference": "CentOS-Stream-8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-22866",
      "notes": [
        {
          "category": "description",
          "text": "Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "CentOS-Stream-8:pam-0:1.3.1-33.el8.i686",
          "CentOS-Stream-8:pam-0:1.3.1-33.el8.tuxcare.els1.i686",
          "CentOS-Stream-8:pam-0:1.3.1-33.el8.tuxcare.els1.x86_64",
          "CentOS-Stream-8:pam-0:1.3.1-33.el8.tuxcare.els2.i686",
          "CentOS-Stream-8:pam-0:1.3.1-33.el8.tuxcare.els2.x86_64",
          "CentOS-Stream-8:pam-0:1.3.1-33.el8.x86_64",
          "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.i686",
          "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.tuxcare.els1.i686",
          "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.tuxcare.els1.x86_64",
          "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.tuxcare.els2.i686",
          "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.tuxcare.els2.x86_64",
          "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2025-22866"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/643735",
          "url": "https://go.dev/cl/643735"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/71383",
          "url": "https://go.dev/issue/71383"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k",
          "url": "https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-3447",
          "url": "https://pkg.go.dev/vuln/GO-2025-3447"
        },
        {
          "category": "external",
          "summary": "https://security.netapp.com/advisory/ntap-20250221-0002/",
          "url": "https://security.netapp.com/advisory/ntap-20250221-0002/"
        }
      ],
      "release_date": "2025-02-06T17:15:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-09-18T20:25:27.939424Z",
          "details": "This issue only affects Go’s P‑256 implementation on PowerPC 64‑bit Little Endian (ppc64le); x86‑64 and ARM64 systems are not impacted, and the affected code path is an internal assembly routine used during elliptic‑curve operations. The leak exposes only a small number of scalar bits and has been assessed as insufficient to recover private keys in well‑known protocols, while obtaining the required high‑fidelity timing measurements over a network is inherently difficult. With confidentiality impact only (no integrity or availability effect) and applicability limited to ppc64le workloads performing P‑256 operations, this can be safely deprioritized in managed enterprise server/VM environments.",
          "product_ids": [
            "CentOS-Stream-8:pam-0:1.3.1-33.el8.i686",
            "CentOS-Stream-8:pam-0:1.3.1-33.el8.tuxcare.els1.i686",
            "CentOS-Stream-8:pam-0:1.3.1-33.el8.tuxcare.els1.x86_64",
            "CentOS-Stream-8:pam-0:1.3.1-33.el8.tuxcare.els2.i686",
            "CentOS-Stream-8:pam-0:1.3.1-33.el8.tuxcare.els2.x86_64",
            "CentOS-Stream-8:pam-0:1.3.1-33.el8.x86_64",
            "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.i686",
            "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.tuxcare.els1.i686",
            "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.tuxcare.els1.x86_64",
            "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.tuxcare.els2.i686",
            "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.tuxcare.els2.x86_64",
            "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CentOS-Stream-8:pam-0:1.3.1-33.el8.i686",
            "CentOS-Stream-8:pam-0:1.3.1-33.el8.tuxcare.els1.i686",
            "CentOS-Stream-8:pam-0:1.3.1-33.el8.tuxcare.els1.x86_64",
            "CentOS-Stream-8:pam-0:1.3.1-33.el8.tuxcare.els2.i686",
            "CentOS-Stream-8:pam-0:1.3.1-33.el8.tuxcare.els2.x86_64",
            "CentOS-Stream-8:pam-0:1.3.1-33.el8.x86_64",
            "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.i686",
            "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.tuxcare.els1.i686",
            "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.tuxcare.els1.x86_64",
            "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.tuxcare.els2.i686",
            "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.tuxcare.els2.x86_64",
            "CentOS-Stream-8:pam-devel-0:1.3.1-33.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}