« Volver al listado

CVE-2025-0509

Estado: AnalizadaMedia (6.8)—

A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Netapp — HCI Compute NodeNetapp — Oncommand Workflow AutomationSparkle-project — Sparkle

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-0509",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-0509",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-04T20:29:02.431803Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "patrick@puiterwijk.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 0.7
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "patrick@puiterwijk.org",
      "affectedData": [
        {
          "repo": "https://github.com/sparkle-project/Sparkle/",
          "vendor": "sparkle-project",
          "product": "Sparkle",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.6.4",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "MacOS"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-02-04T20:15:49.763",
  "references": [
    {
      "url": "https://github.com/sparkle-project/Sparkle/pull/2550",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "patrick@puiterwijk.org"
    },
    {
      "url": "https://sparkle-project.org/documentation/security-and-reliability/",
      "tags": [
        "Patch"
      ],
      "source": "patrick@puiterwijk.org"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20250124-0008/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "patrick@puiterwijk.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-552"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks."
    },
    {
      "lang": "es",
      "value": "Se encontró un problema de seguridad en Sparkle antes de la versión 2.64. Un atacante puede reemplazar una actualización firmada existente con otro payload, omitiendo las comprobaciones de firma de Sparkle (Ed)DSA."
    }
  ],
  "lastModified": "2026-06-17T08:26:37.320",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sparkle-project:sparkle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "338ED490-33A3-4531-B18F-23466B3E5DAD",
              "versionEndExcluding": "2.6.4"
            },
            {
              "criteria": "cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4AFE5CAF-ACA7-4F82-BEC1-69562D75E66E"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3"
            },
            {
              "criteria": "cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4AFE5CAF-ACA7-4F82-BEC1-69562D75E66E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "patrick@puiterwijk.org"
}