CVE-2025-0509

EUVD-2025-0232
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.3 HIGH
ADJACENT_NETWORK
HIGH
HIGH
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 57.33%
Affected Products (NVD)
VendorProductVersion
sparkle-projectsparkle
𝑥
< 2.6.4
netapphci_compute_node
-
netapponcommand_workflow_automation
-
netapphci_compute_node
-
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
openjdk-8
sid
8u504-ga-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
openjdk-13
focal
ignored
jammy
dne
noble
dne
oracular
dne
openjdk-16
focal
ignored
jammy
dne
noble
dne
oracular
dne
openjdk-17
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
oracular
not-affected
openjdk-18
focal
dne
jammy
ignored
noble
dne
oracular
dne
openjdk-19
focal
dne
jammy
dne
noble
dne
oracular
dne
openjdk-21
focal
not-affected
jammy
not-affected
noble
not-affected
oracular
not-affected
openjdk-22
focal
dne
jammy
dne
noble
dne
oracular
not-affected
openjdk-23
focal
dne
jammy
dne
noble
dne
oracular
not-affected
openjdk-8
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
oracular
not-affected
xenial
not-affected
openjdk-9
focal
dne
jammy
dne
noble
dne
oracular
dne
xenial
ignored
openjdk-lts
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
oracular
not-affected