7.3Yüksek
CVE-2025-0509Signing Checks Bypass
Açıklama
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.
Zayıflık türü (CWE):
CWE-552
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| netapp | hci compute node | — | |
| netapp | oncommand workflow automation | — | |
| sparkle-project | Sparkle | < 2.6.4 |
Kaynaklar ve yamalar
- https://github.com/sparkle-project/Sparkle/pull/2550 Issue TrackingPatch
- https://sparkle-project.org/documentation/security-and-reliability/ Patch
- https://security.netapp.com/advisory/ntap-20250124-0008/ Vendor Advisory
CPE eşleşmeleri (NVD) (4)
cpe:2.3:a:sparkle-project:sparkle:*:*:*:*:*:*:*:*< 2.6.4cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*