VDB
RHSA-2025%3A22905
RHSA-2025%3A22905
PUBLISHED
CVSS 8.100000381469727 HIGH
A flaw was found in the npm pbkdf2 library, allowing signature spoofing. When executing in javascript engines other than Nodejs or Nodejs when importing pbkdf2/browser, certain algorithms will silently fail and return invalid data. The return values are predictable, which undermines the security guarantees of the package.
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:ddbbfea6d40e0b978a0715f338aacc758c82a47df12a4ecd46c0ab9ed5bac166_ppc64le as a component of Red Hat OpenShift Pipelines 1.19 | registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:ddbbfea6d40e0b978a0715f338aacc758c82a47df12a4ecd46c0ab9ed5bac166_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:ddbbfea6d40e0b978a0715f338aacc758c82a47df12a4ecd46c0ab9ed5bac166_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:ddbbfea6d40e0b978a0715f338aacc758c82a47df12a4ecd46c0ab9ed5bac166_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:39ce75c550fd693dc0bf2ded4e8d15e20e6b8ba7fe63f095d0642c44d3bf3ed5_amd64 as a component of Red Hat OpenShift Pipelines 1.19 | registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:39ce75c550fd693dc0bf2ded4e8d15e20e6b8ba7fe63f095d0642c44d3bf3ed5_amd64, registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:39ce75c550fd693dc0bf2ded4e8d15e20e6b8ba7fe63f095d0642c44d3bf3ed5_amd64, registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:39ce75c550fd693dc0bf2ded4e8d15e20e6b8ba7fe63f095d0642c44d3bf3ed5_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-webhook-rhel9@sha256:5d968bf07907ef4f6d96b762dcdd78e6f1c77a3febec0ec9140378b57d7e2463_amd64 as a component of Red Hat OpenShift Pipelines 1.19 | registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-webhook-rhel9@sha256:5d968bf07907ef4f6d96b762dcdd78e6f1c77a3febec0ec9140378b57d7e2463_amd64, registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-webhook-rhel9@sha256:5d968bf07907ef4f6d96b762dcdd78e6f1c77a3febec0ec9140378b57d7e2463_amd64, registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-webhook-rhel9@sha256:5d968bf07907ef4f6d96b762dcdd78e6f1c77a3febec0ec9140378b57d7e2463_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9@sha256:f772e6e7c0f1858aaf0e8ad78e27c4da89db45f9a1c633a9be9da5769ba0a4d7_amd64 as a component of Red Hat OpenShift Pipelines 1.19 | *, registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9@sha256:f772e6e7c0f1858aaf0e8ad78e27c4da89db45f9a1c633a9be9da5769ba0a4d7_amd64, registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9@sha256:f772e6e7c0f1858aaf0e8ad78e27c4da89db45f9a1c633a9be9da5769ba0a4d7_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:5bdbe4eeced5d4e13831125bb704c8d7e98cd1fd4cc335a39e204a8676f317eb_arm64 as a component of Red Hat OpenShift Pipelines 1.19 | *, registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:5bdbe4eeced5d4e13831125bb704c8d7e98cd1fd4cc335a39e204a8676f317eb_arm64, registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:5bdbe4eeced5d4e13831125bb704c8d7e98cd1fd4cc335a39e204a8676f317eb_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-triggers-controller-rhel9@sha256:3c8e2ac02103cd8634f0e6bdcbe6f5d1466aefe4403a63bc6f9e7bd3893c3c88_arm64 as a component of Red Hat OpenShift Pipelines 1.19 | registry.redhat.io/openshift-pipelines/pipelines-triggers-controller-rhel9@sha256:3c8e2ac02103cd8634f0e6bdcbe6f5d1466aefe4403a63bc6f9e7bd3893c3c88_arm64, registry.redhat.io/openshift-pipelines/pipelines-triggers-controller-rhel9@sha256:3c8e2ac02103cd8634f0e6bdcbe6f5d1466aefe4403a63bc6f9e7bd3893c3c88_arm64, registry.redhat.io/openshift-pipelines/pipelines-triggers-controller-rhel9@sha256:3c8e2ac02103cd8634f0e6bdcbe6f5d1466aefe4403a63bc6f9e7bd3893c3c88_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-results-retention-policy-agent-rhel9@sha256:e8cf6c64e666e7fbe6d98137e96f098359446a43b7f2213d071a9e87dae20292_s390x as a component of Red Hat OpenShift Pipelines 1.19 | registry.redhat.io/openshift-pipelines/pipelines-results-retention-policy-agent-rhel9@sha256:e8cf6c64e666e7fbe6d98137e96f098359446a43b7f2213d071a9e87dae20292_s390x, registry.redhat.io/openshift-pipelines/pipelines-results-retention-policy-agent-rhel9@sha256:e8cf6c64e666e7fbe6d98137e96f098359446a43b7f2213d071a9e87dae20292_s390x, registry.redhat.io/openshift-pipelines/pipelines-results-retention-policy-agent-rhel9@sha256:e8cf6c64e666e7fbe6d98137e96f098359446a43b7f2213d071a9e87dae20292_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:192657fb34d498d7b731e3852abf89265257f7421e1787bd8fde0019805dc823_arm64 as a component of Red Hat OpenShift Pipelines 1.19 | registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:192657fb34d498d7b731e3852abf89265257f7421e1787bd8fde0019805dc823_arm64, *, registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:192657fb34d498d7b731e3852abf89265257f7421e1787bd8fde0019805dc823_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-webhook-rhel9@sha256:4bf12507f84feb54b8596eb0cd06a0ef7e9f49ebe9c25cc48efb21c89a0d4a07_s390x as a component of Red Hat OpenShift Pipelines 1.19 | registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-webhook-rhel9@sha256:4bf12507f84feb54b8596eb0cd06a0ef7e9f49ebe9c25cc48efb21c89a0d4a07_s390x, registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-webhook-rhel9@sha256:4bf12507f84feb54b8596eb0cd06a0ef7e9f49ebe9c25cc48efb21c89a0d4a07_s390x, registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-webhook-rhel9@sha256:4bf12507f84feb54b8596eb0cd06a0ef7e9f49ebe9c25cc48efb21c89a0d4a07_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-hub-db-migration-rhel9@sha256:6183a74cf4b9c2abbd6511cb94151308f724c85dc63aaea0ae795712f8d48254_ppc64le as a component of Red Hat OpenShift Pipelines 1.19 | registry.redhat.io/openshift-pipelines/pipelines-hub-db-migration-rhel9@sha256:6183a74cf4b9c2abbd6511cb94151308f724c85dc63aaea0ae795712f8d48254_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-hub-db-migration-rhel9@sha256:6183a74cf4b9c2abbd6511cb94151308f724c85dc63aaea0ae795712f8d48254_ppc64le, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel9@sha256:58c4c251e79b007b3bffd7c8436d7b767340ad94eae70d90387d7176d4a5bdf2_amd64 as a component of Red Hat OpenShift Pipelines 1.19 | registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel9@sha256:58c4c251e79b007b3bffd7c8436d7b767340ad94eae70d90387d7176d4a5bdf2_amd64, registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel9@sha256:58c4c251e79b007b3bffd7c8436d7b767340ad94eae70d90387d7176d4a5bdf2_amd64, registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel9@sha256:58c4c251e79b007b3bffd7c8436d7b767340ad94eae70d90387d7176d4a5bdf2_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:28097a799be3dd6d8f500aee2d0ae2ec2a7ccc8a3d2a96a1a4f314a6621ced93_arm64 as a component of Red Hat OpenShift Pipelines 1.19 | registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:28097a799be3dd6d8f500aee2d0ae2ec2a7ccc8a3d2a96a1a4f314a6621ced93_arm64, registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:28097a799be3dd6d8f500aee2d0ae2ec2a7ccc8a3d2a96a1a4f314a6621ced93_arm64, registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:28097a799be3dd6d8f500aee2d0ae2ec2a7ccc8a3d2a96a1a4f314a6621ced93_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9@sha256:1591e38eae1b07ce0fc75a9eb60d97126fb7d36eddd5746686e4570fb1b81427_ppc64le as a component of Red Hat OpenShift Pipelines 1.19 | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9@sha256:1591e38eae1b07ce0fc75a9eb60d97126fb7d36eddd5746686e4570fb1b81427_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9@sha256:1591e38eae1b07ce0fc75a9eb60d97126fb7d36eddd5746686e4570fb1b81427_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9@sha256:1591e38eae1b07ce0fc75a9eb60d97126fb7d36eddd5746686e4570fb1b81427_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-nop-rhel9@sha256:b6397b063b854abc7f6fdede2081a4277f8a528b59778bd944429b28e8f83bc1_s390x as a component of Red Hat OpenShift Pipelines 1.19 | registry.redhat.io/openshift-pipelines/pipelines-nop-rhel9@sha256:b6397b063b854abc7f6fdede2081a4277f8a528b59778bd944429b28e8f83bc1_s390x, registry.redhat.io/openshift-pipelines/pipelines-nop-rhel9@sha256:b6397b063b854abc7f6fdede2081a4277f8a528b59778bd944429b28e8f83bc1_s390x, registry.redhat.io/openshift-pipelines/pipelines-nop-rhel9@sha256:b6397b063b854abc7f6fdede2081a4277f8a528b59778bd944429b28e8f83bc1_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pruner-controller-rhel9@sha256:0152bc65a48f3f6f8080fe4ce2802c1ea17590cf05bc9d499d1bc844f8d2432e_s390x as a component of Red Hat OpenShift Pipelines 1.19 | *, registry.redhat.io/openshift-pipelines/pipelines-pruner-controller-rhel9@sha256:0152bc65a48f3f6f8080fe4ce2802c1ea17590cf05bc9d499d1bc844f8d2432e_s390x, registry.redhat.io/openshift-pipelines/pipelines-pruner-controller-rhel9@sha256:0152bc65a48f3f6f8080fe4ce2802c1ea17590cf05bc9d499d1bc844f8d2432e_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-controller-rhel9@sha256:8d7567c15b6e4f6c2d9a882c172293e6cc39abad8bbea1b3b984236cac12a1f6_amd64 as a component of Red Hat OpenShift Pipelines 1.19 | registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-controller-rhel9@sha256:8d7567c15b6e4f6c2d9a882c172293e6cc39abad8bbea1b3b984236cac12a1f6_amd64, registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-controller-rhel9@sha256:8d7567c15b6e4f6c2d9a882c172293e6cc39abad8bbea1b3b984236cac12a1f6_amd64, registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-controller-rhel9@sha256:8d7567c15b6e4f6c2d9a882c172293e6cc39abad8bbea1b3b984236cac12a1f6_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-triggers-eventlistenersink-rhel9@sha256:57dd3a2b54bf4ce9292498846ea37d6efec0a3c028743c267e69390101b46a4d_arm64 as a component of Red Hat OpenShift Pipelines 1.19 | *, registry.redhat.io/openshift-pipelines/pipelines-triggers-eventlistenersink-rhel9@sha256:57dd3a2b54bf4ce9292498846ea37d6efec0a3c028743c267e69390101b46a4d_arm64, registry.redhat.io/openshift-pipelines/pipelines-triggers-eventlistenersink-rhel9@sha256:57dd3a2b54bf4ce9292498846ea37d6efec0a3c028743c267e69390101b46a4d_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9@sha256:1591e38eae1b07ce0fc75a9eb60d97126fb7d36eddd5746686e4570fb1b81427_ppc64le as a component of Red Hat OpenShift Pipelines 1.19 | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9@sha256:1591e38eae1b07ce0fc75a9eb60d97126fb7d36eddd5746686e4570fb1b81427_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9@sha256:1591e38eae1b07ce0fc75a9eb60d97126fb7d36eddd5746686e4570fb1b81427_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9@sha256:1591e38eae1b07ce0fc75a9eb60d97126fb7d36eddd5746686e4570fb1b81427_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:96b66b1b98dc3e1f95aefcf6d0aea9aa7bb9115bcfdf8ae0206da8fe502d7a4a_s390x as a component of Red Hat OpenShift Pipelines 1.19 | *, registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:96b66b1b98dc3e1f95aefcf6d0aea9aa7bb9115bcfdf8ae0206da8fe502d7a4a_s390x, registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:96b66b1b98dc3e1f95aefcf6d0aea9aa7bb9115bcfdf8ae0206da8fe502d7a4a_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-webhook-rhel9@sha256:7ea98459bc424770c56ea071d3f9e4656bc944cd1932e8ed2581b263021a2bdc_arm64 as a component of Red Hat OpenShift Pipelines 1.19 | *, *, registry.redhat.io/openshift-pipelines/pipelines-webhook-rhel9@sha256:7ea98459bc424770c56ea071d3f9e4656bc944cd1932e8ed2581b263021a2bdc_arm64 |
…and 212 more
Timeline
- Dec 9, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 16, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:22905 advisory
- https://access.redhat.com/security/cve/CVE-2025-64756 advisory
- https://access.redhat.com/security/cve/CVE-2025-6545 advisory
- https://access.redhat.com/security/cve/CVE-2025-6547 advisory
- https://access.redhat.com/security/cve/CVE-2025-9287 advisory
- https://access.redhat.com/security/cve/CVE-2025-9288 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22905.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2374370 issue
- https://www.cve.org/CVERecord?id=CVE-2025-6545 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-6545 advisory
- https://github.com/browserify/pbkdf2/commit/9699045c37a07f8319cfb8d44e2ff4252d7a7078 advisory
- https://github.com/browserify/pbkdf2/commit/e3102a8cd4830a3ac85cd0dd011cc002fdde33bb advisory
- https://github.com/browserify/pbkdf2/security/advisories/GHSA-h7cp-r72f-jxh6 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2374378 issue
- https://www.cve.org/CVERecord?id=CVE-2025-6547 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-6547 advisory
- https://github.com/browserify/pbkdf2/security/advisories/GHSA-v62p-rq8g-8h59 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2389932 issue
…and 14 more