GHSA-wc9m-r3v6-9p5h

Suggest an improvement
Source
https://github.com/advisories/GHSA-wc9m-r3v6-9p5h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-wc9m-r3v6-9p5h/GHSA-wc9m-r3v6-9p5h.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-wc9m-r3v6-9p5h
Aliases
Downstream
Related
Published
2025-02-04T21:32:28Z
Modified
2025-02-04T23:27:03.335861Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Sparkle Signing Checks Bypass
Details

A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

Database specific 
{
    "severity": "HIGH",
    "nvd_published_at": "2025-02-04T20:15:49Z",
    "github_reviewed_at": "2025-02-04T23:18:58Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-552"
    ]
}
References

Affected packages

SwiftURL / github.com/sparkle-project/Sparkle

Package

Name
github.com/sparkle-project/Sparkle
Purl
pkg:swift/github.com/sparkle-project/Sparkle

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.6.4

Database specific

last_known_affected_version_range

"<= 2.6.3"