Red Hat CVE-2025-6547

PBKDF2 (Password-Based Key Derivation Function 2) is a standardized key derivation function defined in RFC 2898, commonly used for password hashing and cryptographic key generation. The vulnerability stems from CWE-20 (Improper Input Validation), indicating that the library fails to properly validate inputs before processing them in cryptographic operations. This inadequate validation allows attackers to manipulate input parameters or bypass verification checks, leading to signature spoofing—a critical failure where an attacker can forge valid-appearing signatures without possessing the correct cryptographic key. The affected CPE scope includes pbkdf2 library implementations through version 3.1.2. The vulnerability appears in the signature validation logic rather than the core key derivation algorithm itself, suggesting the issue lies in how derived keys are verified or how signature operations handle their inputs.