GitHub Advisoryadvisory · SwiftURL

GHSA-wc9m-r3v6-9p5h Sparkle Signing Checks Bypass

HIGH Published 2025-02-04 Modified 2025-02-04 Official page ↗
Aliases
CVE-2025-0509
Ecosystem
SwiftURL
Packages
github.com/sparkle-project/Sparkle
Severity
High
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-552
Reviewed
2025-02-04

Affected packages

• SwiftURL github.com/sparkle-project/Sparkle: < 2.6.4 → fixed in 2.6.4

Description

A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

Related

Alias · CVE (1)

  • CVE-2025-0509 A security issue was found in Sparkle before version 2.6.4. vulnerability

Weakness · CWE (1)

  • CWE-552 Files or Directories Accessible to External Parties weakness

References