Most recent entries from all

bdu:2025-07454

certfr-2025-avi-0724 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2025-avi-0724

EUVD-2026-268151

fkie_cve-2025-6547

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.

GHSA-v62p-rq8g-8h59 — pbkdf2 silently disregards Uint8Array input, returning static keys

Affected: npm: pbkdf2

### Summary

On historic but declared as supported Node.js versions (0.12-2.x), pbkdf2 silently disregards Uint8Array input

This only affects Node.js <3.0.0, but `pbkdf2` claims to: * Support Node.js [>= 0.12](https://github.com/browserify/pbkdf2/blob/v3.1.2/package.json#L62) (and there seems to be ongoing effort in this repo to maintain that) * Support `Uint8Array` input (input is typechecked against Uint8Array, and the error message includes e.g. "Password must be a string, a Buffer, a typed array or a DataView"

### Details

The error is in `toBuffer` method

This vulnerability somehow even made it to tests: https://github.com/browserify/pbkdf2/commit/eb9f97a66ed83836bebc4ff563a1588248708501 There, `resultsOld` (where mismatch `results`) are just invalid output generated from empty password/salt instead of the supplied one

### PoC

On Node.js/io.js < 3.0.0

```console > require('pbkdf2').pbkdf2Sync(new Uint8Array([1,2,3]), new Uint8Array([1,3,4]), 1024, 32, 'sha256') <Buffer 21 53 cd 5b a5 f0 15 39 2f 68 e2 40 8b 21 ba ca 0e dc 7b 20 d5 45 a4 8a ea b5 95 9f f0 be bf 66>

// But that's just a hash of empty data with empty password: > require('pbkdf2').pbkdf2Sync('', '', 1024, 32, 'sha256') <Buffer 21 53 cd 5b a5 f0 15 39 2f 68 e2 40 8b 21 ba ca 0e dc 7b 20 d5 45 a4 8a ea b5 95 9f f0 be bf 66>

// Node.js crypto is fine even on that version: > require('crypto').pbkdf2Sync(new Uint8Array([1,2,3]), new Uint8Array([1,3,4]), 1024, 32, 'sha256') <Buffer 78 10 cc 84 b7 bb 85…

openSUSE-SU-2026:11126-1 — velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media

velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media

RHSA-2025:10738 — Red Hat Security Advisory: Kiali 2.4.7 for Red Hat OpenShift Service Mesh 3.0

pbkdf2: pbkdf2 silently returns predictable key material pbkdf2: pbkdf2 silently returns static keys

Withdrawn: UBUNTU-CVE-2025-6547

Withdrawn by the publisher.

Affected: Ubuntu:18.04:LTS: node-pbkdf2, Ubuntu:20.04:LTS: node-pbkdf2, Ubuntu:22.04:LTS: node-pbkdf2, Ubuntu:24.04:LTS: node-pbkdf2, Ubuntu:25.10: node-pbkdf2, Ubuntu:26.04:LTS: node-pbkdf2

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.

WID-SEC-W-2025-1409 — IBM App Connect Enterprise: Mehrere Schwachstellen ermöglichen Manipulation von Daten

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Daten zu manipulieren.