Nixpkgs Security Tracker

Login with GitHub

Suggestions search

Untriaged
Filter by:
With package: python312Packages.pbkdf2

Found 2 matching suggestions

View:
Compact
Detailed
Permalink CVE-2025-6547
created 6 months ago
On Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keys

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.

References

Affected products

pbkdf2
  • ==>= 1 <=3.1.2
  • ==<=3.1.2

Matching in nixpkgs

pkgs.fastpbkdf2

Fast PBKDF2-HMAC-{SHA1,SHA256,SHA512} implementation in C

  • nixos-unstable -

Package maintainers

Permalink CVE-2025-6545
created 6 months ago
pbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2.

References

Affected products

pbkdf2
  • =<3.1.2

Matching in nixpkgs

pkgs.fastpbkdf2

Fast PBKDF2-HMAC-{SHA1,SHA256,SHA512} implementation in C

  • nixos-unstable -

Package maintainers