2 lines
3.3 KiB
JSON
2 lines
3.3 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["MacOS"],"product":"Sparkle","repo":"https://github.com/sparkle-project/Sparkle/","vendor":"sparkle-project","versions":[{"lessThan":"2.6.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"patrick@puiterwijk.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:sparkle-project:sparkle:*:*:*:*:*:*:*:*","matchCriteriaId":"338ED490-33A3-4531-B18F-23466B3E5DAD","versionEndExcluding":"2.6.4","vulnerable":true},{"criteria":"cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*","matchCriteriaId":"4AFE5CAF-ACA7-4F82-BEC1-69562D75E66E","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*","matchCriteriaId":"5735E553-9731-4AAC-BCFF-989377F817B3","vulnerable":true},{"criteria":"cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*","matchCriteriaId":"4AFE5CAF-ACA7-4F82-BEC1-69562D75E66E","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks."},{"lang":"es","value":"Se encontró un problema de seguridad en Sparkle antes de la versión 2.64. Un atacante puede reemplazar una actualización firmada existente con otro payload, omitiendo las comprobaciones de firma de Sparkle (Ed)DSA."}],"id":"CVE-2025-0509","lastModified":"2026-06-17T08:26:37.320","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.7,"impactScore":6.0,"source":"patrick@puiterwijk.org","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-0509","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-02-04T20:29:02.431803Z","version":"2.0.3"}}]},"published":"2025-02-04T20:15:49.763","references":[{"source":"patrick@puiterwijk.org","tags":["Issue Tracking","Patch"],"url":"https://github.com/sparkle-project/Sparkle/pull/2550"},{"source":"patrick@puiterwijk.org","tags":["Patch"],"url":"https://sparkle-project.org/documentation/security-and-reliability/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://security.netapp.com/advisory/ntap-20250124-0008/"}],"sourceIdentifier":"patrick@puiterwijk.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-552"}],"source":"patrick@puiterwijk.org","type":"Secondary"}]}
|