CVE-2025-0509

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-0509
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 0.7 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/sparkle-project/Sparkle/pull/2550
https://sparkle-project.org/documentation/security-and-reliability/
https://security.netapp.com/advisory/ntap-20250124-0008/
Configurations

No configuration.

History

17 Feb 2025, 12:15

Type Values Removed Values Added
Summary
  • (es) Se encontró un problema de seguridad en Sparkle antes de la versión 2.64. Un atacante puede reemplazar una actualización firmada existente con otro payload, omitiendo las comprobaciones de firma de Sparkle (Ed)DSA.
Summary (en) A security issue was found in Sparkle before version 2.64. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks. (en) A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

04 Feb 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-04 20:15

Updated : 2025-02-17 12:15

NVD link : CVE-2025-0509

Mitre link : CVE-2025-0509

CVE.ORG link : CVE-2025-0509

JSON object : View

Products Affected

No product.

CWE
CWE-552

Files or Directories Accessible to External Parties