{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2025-0509","sourceIdentifier":"patrick@puiterwijk.org","published":"2025-02-04T20:15:49.763","lastModified":"2026-06-17T08:26:37.320","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks."},{"lang":"es","value":"Se encontró un problema de seguridad en Sparkle antes de la versión 2.64. Un atacante puede reemplazar una actualización firmada existente con otro payload, omitiendo las comprobaciones de firma de Sparkle (Ed)DSA."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"vendor":"sparkle-project","product":"Sparkle","defaultStatus":"unaffected","platforms":["MacOS"],"repo":"https://github.com/sparkle-project/Sparkle/","versions":[{"version":"0","lessThan":"2.6.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.7,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-04T20:29:02.431803Z","id":"CVE-2025-0509","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-552"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sparkle-project:sparkle:*:*:*:*:*:*:*:*","versionEndExcluding":"2.6.4","matchCriteriaId":"338ED490-33A3-4531-B18F-23466B3E5DAD"},{"vulnerable":true,"criteria":"cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*","matchCriteriaId":"4AFE5CAF-ACA7-4F82-BEC1-69562D75E66E"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*","matchCriteriaId":"5735E553-9731-4AAC-BCFF-989377F817B3"},{"vulnerable":true,"criteria":"cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*","matchCriteriaId":"4AFE5CAF-ACA7-4F82-BEC1-69562D75E66E"}]}]}],"references":[{"url":"https://github.com/sparkle-project/Sparkle/pull/2550","source":"patrick@puiterwijk.org","tags":["Issue Tracking","Patch"]},{"url":"https://sparkle-project.org/documentation/security-and-reliability/","source":"patrick@puiterwijk.org","tags":["Patch"]},{"url":"https://security.netapp.com/advisory/ntap-20250124-0008/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}