EUVD-2025-28751
GHSA-v62p-rq8g-8h59
CVSS VectorNVD
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
Lifecycle Timeline
4DescriptionNVD
Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.
AnalysisAI
CVE-2025-6547 is an improper input validation vulnerability in the pbkdf2 cryptographic library (versions ≤3.1.2) that allows attackers to spoof cryptographic signatures through inadequate validation mechanisms. This affects any application using vulnerable pbkdf2 versions for password hashing or key derivation, potentially compromising authentication and integrity verification. With a CVSS score of 9.1 and high integrity/signature impact ratings, this vulnerability has significant real-world implications for systems relying on pbkdf2 for security-critical operations.
Technical ContextAI
PBKDF2 (Password-Based Key Derivation Function 2) is a standardized key derivation function defined in RFC 2898, commonly used for password hashing and cryptographic key generation. The vulnerability stems from CWE-20 (Improper Input Validation), indicating that the library fails to properly validate inputs before processing them in cryptographic operations. This inadequate validation allows attackers to manipulate input parameters or bypass verification checks, leading to signature spoofing—a critical failure where an attacker can forge valid-appearing signatures without possessing the correct cryptographic key. The affected CPE scope includes pbkdf2 library implementations through version 3.1.2. The vulnerability appears in the signature validation logic rather than the core key derivation algorithm itself, suggesting the issue lies in how derived keys are verified or how signature operations handle their inputs.
Affected ProductsAI
- product: pbkdf2; affected_versions: ≤3.1.2; severity: Critical; notes: All implementations of pbkdf2 library at version 3.1.2 and earlier are vulnerable. This includes Node.js pbkdf2, Python pbkdf2, and other language-specific implementations of the PBKDF2 standard.
RemediationAI
- action: Upgrade pbkdf2 library; target_version: >3.1.2; details: Immediate patching is required. Update to the latest stable version of pbkdf2 from the official repository or package manager (npm, pip, etc. depending on language/framework).
- action: Validate input sanitization; details: Implement strict input validation at the application layer for all cryptographic operations, particularly signature verification and key derivation parameters. Do not rely solely on library input handling.
- action: Implement cryptographic key rotation; details: If signature spoofing has occurred, rotate all cryptographic keys and re-verify integrity of signed data generated during the vulnerable period.
- action: Audit signature verification logic; details: Review application code using pbkdf2 for signature operations. Ensure proper constant-time comparison and complete validation of all signature parameters.
- action: Monitor for exploitation; details: Check security logs and audit trails for suspicious signature validation failures, unexpected authentication bypasses, or tampered data integrity checks during periods when vulnerable pbkdf2 versions were in use.
Vendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| upstream | needs-triage | - |
| oracular | ignored | end of life, was needs-triage |
| questing | needs-triage | - |
| plucky | ignored | end of life, was needs-triage |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 3.1.1-1 | - |
| bookworm, trixie | fixed | 3.1.2-3 | - |
| forky, sid | fixed | 3.1.5+~3.1.2-1 | - |
| (unstable) | not-affected | - | - |
Share
External POC / Exploit Code
Leaving vuln.today