high7.3
CVE-2025-0509
Sparkle Signing Checks Bypass
Impact
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| swift | github.com/sparkle-project/Sparkle | <= 2.6.3 | 2.6.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sparkle-Project | Sparkle | before 2.6.4 |
| Netapp | Hci Compute Node | All versions |
| Netapp | Oncommand Workflow Automation | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/sparkle-project/Sparkle/pull/2550
- https://sparkle-project.org/documentation/security-and-reliability/
- https://security.netapp.com/advisory/ntap-20250124-0008/
- https://github.com/advisories/GHSA-wc9m-r3v6-9p5h
- https://nvd.nist.gov/vuln/detail/CVE-2025-0509
- https://security.netapp.com/advisory/ntap-20250124-0008
- https://sparkle-project.org/documentation/security-and-reliability