Vulnerability · Published Sep 17, 2025 · Assigned by GitHub_M

CVE-2025-59339The Bastion ttyrec files are not signed after encryption by the osh-encrypt-rsync script

Medium 4.4

In plain English

A medium-severity security flaw in the-bastion from ovh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)0.1%top 99.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. Session-recording ttyrec files, may be handled by the provided osh-encrypt-rsync script that is a helper to rotate, encrypt, sign, copy, and optionally move them to a remote storage periodically, if configured to. When running, the script properly rotates and encrypts the files using the provided GPG key(s), but silently fails to sign them, even if asked to.

Affected products (as reported)

Vendor	Product	Versions
ovh	the-bastion	< 3.22.00

Weakness: CWE-325 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/ovh/the-bastion/security/advisories/GHSA-h66q-g57p-rgg6 x_refsource_CONFIRM
https://github.com/ovh/the-bastion/commit/9bc85ec3f4b724f903773ba64909777c4826a13f x_refsource_MISC