CVE-2025-0509

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-0509
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 0.7 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/sparkle-project/Sparkle/pull/2550 Issue Tracking Patch
https://sparkle-project.org/documentation/security-and-reliability/ Patch
https://security.netapp.com/advisory/ntap-20250124-0008/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sparkle-project:sparkle:*:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*
History

05 Aug 2025, 14:35

Type Values Removed Values Added
References () https://github.com/sparkle-project/Sparkle/pull/2550 - () https://github.com/sparkle-project/Sparkle/pull/2550 - Issue Tracking, Patch
References () https://sparkle-project.org/documentation/security-and-reliability/ - () https://sparkle-project.org/documentation/security-and-reliability/ - Patch
References () https://security.netapp.com/advisory/ntap-20250124-0008/ - () https://security.netapp.com/advisory/ntap-20250124-0008/ - Vendor Advisory
CPE cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*
cpe:2.3:a:sparkle-project:sparkle:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
First Time Sparkle-project
Netapp
Netapp oncommand Workflow Automation
Netapp hci Compute Node
Sparkle-project sparkle

17 Feb 2025, 12:15

Type Values Removed Values Added
Summary
  • (es) Se encontró un problema de seguridad en Sparkle antes de la versión 2.64. Un atacante puede reemplazar una actualización firmada existente con otro payload, omitiendo las comprobaciones de firma de Sparkle (Ed)DSA.
Summary (en) A security issue was found in Sparkle before version 2.64. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks. (en) A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

04 Feb 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-04 20:15

Updated : 2025-08-05 14:35

NVD link : CVE-2025-0509

Mitre link : CVE-2025-0509

CVE.ORG link : CVE-2025-0509

JSON object : View

Products Affected

netapp

  • hci_compute_node
  • oncommand_workflow_automation

sparkle-project

  • sparkle
CWE
CWE-552

Files or Directories Accessible to External Parties