CVE-2025-59339 The Bastion ttyrec files are not signed after encryption by the osh-encrypt-rsync script
The osh-encrypt-rsync script fails to sign encrypted session logs, allowing attackers to tamper with audit trails without detection.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-59339?
CVE-2025-59339 is a medium-severity vulnerability in ovh the-bastion, published on 17 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. Session-recording ttyrec files, may be handled by the provided osh-encrypt-rsync script that is a helper to rotate, encrypt, sign, copy, and optionally move them to a remote storage periodically, if configured to. When running, the script properly rotates and encrypts the files using the provided GPG key(s), but silently fails to sign them, even if asked to.
Weakness: CWE-325
Which versions are affected by CVE-2025-59339?
How do I fix CVE-2025-59339?
No fix has been published for CVE-2025-59339 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-59339 being exploited?
There is no known exploitation of CVE-2025-59339 in the wild and no public exploit code.
Sources
Also known as GHSA-h66q-g57p-rgg6.