Vulnerability in Ovh The-Bastion
CVE-2025-59339
The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. Session-recording ttyrec files, may be handled by the provided osh-encrypt-rsync script that is a helper to rotate, encrypt, sign, copy, and optionally move them to a remote storage periodically, if configured to. When running, the script properly rotates and encrypts the files using the provided GPG key(s), but silently fails to sign them, even if asked to.
EPSS: 0.001 (0.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Ovh The-bastion — versions < 3.22.00
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-59339?
- CVE-2025-59339 is a medium-severity vulnerability in Ovh The-Bastion, classified under Missing Cryptographic Step. CVSS score: 4.4/10. Published 2025-09-17.
- How severe is CVE-2025-59339?
- Medium severity. CVSS v3 base score is 4.4 out of 10.
- Is CVE-2025-59339 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.