> CVE-2025-6545

« BACK_TO_HOME
PUBLISHED
2025-06-23 19:15
MODIFIED
2025-06-23 20:16
EPSS (Prob. Exploit)
0.45%
Top 60.9%
DATA SOURCES:
NVD 🔗 2025-10-18 RED HAT 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-11 OSV 🔗 2026-11-08

> DESCRIPTION

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2.

> AFFECTED_PRODUCTS

Red Hat - Red Hat OpenShift Service Mesh 3.0
Red Hat - Red Hat Developer Hub 1.7
Red Hat - Red Hat Trusted Artifact Signer 1.2

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: RHTAS 1.2.1- Red Hat Trusted Artifact Signer Release
The 1.2.1 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details see [product documentation](https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1).
Red Hat Security Advisory: Red Hat Developer Hub 1.7.0 release.
Red Hat Developer Hub 1.7.0 has been released.
Red Hat Security Advisory: Kiali 2.4.7 for Red Hat OpenShift Service Mesh 3.0
Kiali 2.4.7 for Red Hat OpenShift Service Mesh 3.0 This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is a...
Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.19.4
The 1.19.4 GA release of Red Hat OpenShift Pipelines Operator.. For more details see [product documentation](https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines).
Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.3
The 1.15.3 GA release of Red Hat OpenShift Pipelines Operator.. For more details see [product documentation](https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines).
Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.4
The 1.15.4 GA release of Red Hat OpenShift Pipelines Operator.. For more details see [product documentation](https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines).

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Important

> GITHUB SECURITY ADVISORY

GHSA-h7cp-r72f-jxh6 CRITICAL

pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos

AFFECTED PACKAGES:
NPM / pbkdf2
>= 3.0.10, <= 3.1.2
Fixed in: 3.1.3

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

pbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js

AFFECTED PACKAGES:
Unknown / Unknown
11 versions affected
ALIASES:
GHSA-h7cp-r72f-jxh6

> HISTORIQUE DES MODIFICATIONS

Première apparition
23/06/2025 19:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:05
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
📊 ENRICHISSEMENT 18/10/2025 12:12
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Important", "severity_scale": null }
📊 ENRICHISSEMENT 18/10/2025 12:12
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 3 Dernière mise à jour: 1 year ago
« BACK_TO_HOME