CVE-2025-0509

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-0509
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 0.7 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/sparkle-project/Sparkle/pull/2550 Issue Tracking Patch
https://sparkle-project.org/documentation/security-and-reliability/ Patch
https://security.netapp.com/advisory/ntap-20250124-0008/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sparkle-project:sparkle:*:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*
History

05 Aug 2025, 14:35

Type Values Removed Values Added
First Time Sparkle-project
Netapp oncommand Workflow Automation
Netapp hci Compute Node
Sparkle-project sparkle
Netapp
CPE cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*
cpe:2.3:a:sparkle-project:sparkle:*:*:*:*:*:*:*:*
References () https://github.com/sparkle-project/Sparkle/pull/2550 - () https://github.com/sparkle-project/Sparkle/pull/2550 - Issue Tracking, Patch
References () https://sparkle-project.org/documentation/security-and-reliability/ - () https://sparkle-project.org/documentation/security-and-reliability/ - Patch
References () https://security.netapp.com/advisory/ntap-20250124-0008/ - () https://security.netapp.com/advisory/ntap-20250124-0008/ - Vendor Advisory

17 Feb 2025, 12:15

Type Values Removed Values Added
Summary
  • (es) Se encontró un problema de seguridad en Sparkle antes de la versión 2.64. Un atacante puede reemplazar una actualización firmada existente con otro payload, omitiendo las comprobaciones de firma de Sparkle (Ed)DSA.
Summary (en) A security issue was found in Sparkle before version 2.64. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks. (en) A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

04 Feb 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-04 20:15

Updated : 2025-08-05 14:35

NVD link : CVE-2025-0509

Mitre link : CVE-2025-0509

CVE.ORG link : CVE-2025-0509

JSON object : View

Products Affected

sparkle-project

  • sparkle

netapp

  • oncommand_workflow_automation
  • hci_compute_node
CWE
CWE-552

Files or Directories Accessible to External Parties