7.3Hoch
CVE-2025-0509Signing Checks Bypass
Beschreibung
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.
Schwachstellentyp (CWE):
CWE-552
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| netapp | hci compute node | — | |
| netapp | oncommand workflow automation | — | |
| sparkle-project | Sparkle | < 2.6.4 |
Referenzen und Patches
- https://github.com/sparkle-project/Sparkle/pull/2550 Issue TrackingPatch
- https://sparkle-project.org/documentation/security-and-reliability/ Patch
- https://security.netapp.com/advisory/ntap-20250124-0008/ Vendor Advisory
CPE-Treffer (NVD) (4)
cpe:2.3:a:sparkle-project:sparkle:*:*:*:*:*:*:*:*< 2.6.4cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*