What is GHSA-wc9m-r3v6-9p5h?

GHSA-wc9m-r3v6-9p5h is a security advisory published by GitHub Security Advisories with High severity. Sparkle Signing Checks Bypass

Which CVE IDs does GHSA-wc9m-r3v6-9p5h cover?

GHSA-wc9m-r3v6-9p5h covers the following CVE IDs: CVE-2025-0509. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wc9m-r3v6-9p5h?

GHSA-wc9m-r3v6-9p5h has a CVSS v3 base score of 7.3, published by GitHub Security Advisories.

Which products are affected by GHSA-wc9m-r3v6-9p5h?

GHSA-wc9m-r3v6-9p5h affects 1 product, including: swift/github.com/sparkle-project/Sparkle:\u003c= 2.6.3.

GHSA-wc9m-r3v6-9p5hHighCVSS 7.3

Sparkle Signing Checks Bypass

Vendor

GitHub Security Advisories

Published

February 4, 2025

Last Modified

February 4, 2025

🔗 CVE IDs covered (1)

CVE-2025-0509 →

📋 Description

A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

🎯 Affected products1

swift/github.com/sparkle-project/Sparkle:<= 2.6.3

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-0509
https://github.com/sparkle-project/Sparkle/pull/2550
https://security.netapp.com/advisory/ntap-20250124-0008
https://sparkle-project.org/documentation/security-and-reliability
https://github.com/advisories/GHSA-wc9m-r3v6-9p5h