CVE-2025-0509

Published: Feb 4, 2025Modified: Jun 17, 2026

6.8

Vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.9 / Impact: 5.9

Source: NVD

Description

A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

Affected (3)

Products: Sparkle Project: Sparkle · Netapp: Hci Compute Node, Oncommand Workflow Automation

1 product

2 products

Oncommand Workflow Automation

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sparkle Project Sparkle	Before 2.6.4

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Netapp Hci Compute Node	All versions
Netapp Oncommand Workflow Automation	All versions

Related CWEs

CWE-552

Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.

References (3)

https://github.com/sparkle-project/Sparkle/pull/2550

Source: patrick@puiterwijk.org

Issue TrackingPatch

https://sparkle-project.org/documentation/security-and-reliability/

Source: patrick@puiterwijk.org

Patch

https://security.netapp.com/advisory/ntap-20250124-0008/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.