> CVE-2025-6547

« BACK_TO_HOME
PUBLISHED
2025-06-23 19:15
MODIFIED
2025-06-23 20:16
EPSS (Prob. Exploit)
0.46%
Top 59.6%
DATA SOURCES:
NVD 🔗 2025-10-18 RED HAT 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-11 OSV 🔗 2026-11-08

> DESCRIPTION

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.

> AFFECTED_PRODUCTS

Red Hat - Red Hat OpenShift Service Mesh 3.0
Red Hat - Red Hat Trusted Artifact Signer 1.2

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: RHTAS 1.2.1- Red Hat Trusted Artifact Signer Release
The 1.2.1 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details see [product documentation](https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1).
Red Hat Security Advisory: Kiali 2.4.7 for Red Hat OpenShift Service Mesh 3.0
Kiali 2.4.7 for Red Hat OpenShift Service Mesh 3.0 This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is a...
Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.19.4
The 1.19.4 GA release of Red Hat OpenShift Pipelines Operator.. For more details see [product documentation](https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines).
Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.3
The 1.15.3 GA release of Red Hat OpenShift Pipelines Operator.. For more details see [product documentation](https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines).
Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.4
The 1.15.4 GA release of Red Hat OpenShift Pipelines Operator.. For more details see [product documentation](https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines).

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Important

> GITHUB SECURITY ADVISORY

GHSA-v62p-rq8g-8h59 CRITICAL

pbkdf2 silently disregards Uint8Array input, returning static keys

AFFECTED PACKAGES:
NPM / pbkdf2
>= 1.0.0, <= 3.1.2
Fixed in: 3.1.3

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

On Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keys

AFFECTED PACKAGES:
Unknown / Unknown
23 versions affected
ALIASES:
GHSA-v62p-rq8g-8h59

> HISTORIQUE DES MODIFICATIONS

Première apparition
23/06/2025 19:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:05
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
📊 ENRICHISSEMENT 18/10/2025 12:12
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Important", "severity_scale": null }
📊 ENRICHISSEMENT 18/10/2025 12:12
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 3 Dernière mise à jour: 1 year ago
« BACK_TO_HOME