7.3Alta
CVE-2025-0509Signing Checks Bypass
Descripción
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.
Debilidad (CWE):
CWE-552
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| netapp | hci compute node | — | |
| netapp | oncommand workflow automation | — | |
| sparkle-project | Sparkle | < 2.6.4 |
Referencias y parches
- https://github.com/sparkle-project/Sparkle/pull/2550 Issue TrackingPatch
- https://sparkle-project.org/documentation/security-and-reliability/ Patch
- https://security.netapp.com/advisory/ntap-20250124-0008/ Vendor Advisory
Coincidencias CPE (NVD) (4)
cpe:2.3:a:sparkle-project:sparkle:*:*:*:*:*:*:*:*< 2.6.4cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*