CVE-2025-43023 is a critical (CVSS 9.1) weakness in how HP Linux Imaging and Printing (HPLIP) software releases were signed. A weak DSA key was used, which makes signature checks unreliable. HP now publishes a stronger RSA key and fingerprint, so verify downloads against it and prefer distribution packages.
What's affected
The HP Linux Imaging and Printing Software, per HP's wording in the record, which refers to the documentation. This is not a bug in the printing code. It is a weakness in how users were told to verify downloads. The record says the cause is the use of a weak code signing key, the Digital Signature Algorithm (DSA).
The weakness is tagged CWE-347, improper verification of a cryptographic signature. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
A public post on the oss-security mailing list explains the context. It quotes the researchers who found the issue as saying the release signing key was a 1024-bit DSA key, and that the install instructions were open to a key spoofing attack that could lead to verification of malicious code run with root rights. The same post says a deceptive key exploiting the short key id had been published by an unknown person. It also says HP now signs packages with a new RSA 4096 bit key and lists the full fingerprint in its documentation.
The record does not list a fixed software version, because the fix is in the signing key and the documentation. Check HP's bulletin for details.
How to check if you're exposed
Think about how you installed HPLIP. If you used your Linux distribution's package manager, the distribution's own signing applies and this issue is much less relevant. If you downloaded the source tarball from HP and verified it by fetching a key from a public keyserver using a short key id, you are in the affected group.
To see where an installed copy came from on Debian or Ubuntu:
apt policy hplip
On Fedora or RHEL based systems:
dnf info hplip
Check the install steps in your own build scripts or documentation too. Any step that imports a key using a short key id deserves review.
What to do now
- Stop using short key ids to fetch signing keys. Use the full fingerprint instead.
- Take the current key and fingerprint only from HP's official documentation, over HTTPS.
- Re-verify any HPLIP source you built from a tarball, against the new RSA 4096 key.
- Prefer packages from your distribution, which carry their own signing chain.
- Search internal build scripts and runbooks for the old verification steps and update them.
- Record which machines run HPLIP, so you can rebuild if a download turns out to be untrustworthy.
Why it matters
A signature is only as good as the key behind it and the way people check it. Short key ids can be collided on purpose, so a lookup by short id can return a key that looks right and is not. When that check protects software that runs with root rights, the risk is serious even without a bug in the code.
The record does not flag the CVE as listed in CISA's Known Exploited Vulnerabilities catalog (KEV). The oss-security post says an unknown developer published a deceptive key, which is a reason to review old installs. It does not report a confirmed attack through it.
Quick check
Do I need to patch my printers?
No printer firmware is involved. This concerns how HPLIP software releases were signed and how users verified them. Check how you obtained HPLIP.
Are distribution packages affected?
The oss-security post notes that some distributions changed their packages to use a bundled signing key instead of downloading one from keyservers. Check your distribution's advisory for specifics.
Sources
- Gold entry for CVE-2025-43023
- Gold entry for CWE-347
- oss-security post on CVE-2025-43023
- HP security bulletin HPSBPI04033, listed in the CVE record
HP's support site blocked my automated fetch. The oss-security post is the page I read in full.
Last reviewed: 18 October 2026.
