PT-2025-19901 · Finit+1 · Finit+1

Aanderse · Published 2025-05-06 · Updated 2025-05-06 · CVE-2025-32022

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Finit versions 4.2 through 4.11

Description Finit's urandom plugin has a heap buffer overwrite vulnerability at boot, which can lead to random instabilities and undefined behavior. The urandom plugin is enabled by default.

Recommendations For Finit versions 4.2 through 4.11, disable the urandom plugin in the call to the configure script as a temporary workaround. Upgrade to Finit 4.12 to fully resolve the issue.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2025-32022

GHSA-FV6V-VW8H-9X79

Affected Products

Debian

Finit

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32022.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2025-32022 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-32022 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-32022 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-32022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32022 · Security Note
• https://ubuntu.com/security/CVE-2025-32022 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32022 · Vendor Advisory
• https://github.com/troglobit/finit/commit/3feff37ba51fa0a6a0a06f59682a0918aa5b04de · Note
• https://github.com/troglobit/finit/security/advisories/GHSA-fv6v-vw8h-9x79 · Note
• https://twitter.com/CVEnew/status/1919802964299890891 · Twitter Post
• https://t.me/cvedetector/24620 · Telegram Post
• https://t.me/cvetracker/23194 · Telegram Post