Flaw in Seed Decryption Logic in Cloudflare's Gokey

CVE-2025-13353

What is CVE-2025-13353?

A significant flaw in the seed decryption logic of Gokey prior to version 0.2.0 allows passwords to be derived improperly, utilizing only a limited portion of the seed data. This compromises the entropy of generated keys and leaves vulnerabilities for malicious entities to recover passwords if they possess the seed file. The latest version (0.2.0 and above) rectifies the issue, requiring users to regenerate affected secrets and implement appropriate secret rotation practices to secure their systems.

References