PT-2025-34162 · Pypi+3 · Cipher-Base+3

Chalker · Published 2025-08-20 · Updated 2026-03-16 · CVE-2025-9287

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

cipher-base versions through 1.0.4

Description:

An improper input validation issue exists in cipher-base, allowing input data manipulation. This is due to missing input type checks, which can lead to invalid value calculations, hash state rewinding (potentially turning a tagged hash into an untagged hash), and denial-of-service conditions when processing malicious JSON-stringifyable input. Specifically, manipulating the length property within the input data can cause unexpected behavior in the hashing process. This can potentially lead to collisions, incorrect hash values, and in some cases, even private key extraction from cryptographic libraries.

Recommendations:

Update cipher-base to a version beyond 1.0.4.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2025-10188

CVE-2025-9287

DLA-4291-1

DSA-5986-1

GHSA-95M3-7Q98-8XR5

GHSA-CPQ7-6GPM-G9RC

OPENSUSE-SU-2025:15484-1

USN-7746-1

Affected Products

Debian

Linuxmint

Ubuntu

Cipher-Base

References · 36

• 🔥 https://github.com/browserify/cipher-base/security/advisories/GHSA-cpq7-6gpm-g9rc · Exploit
• https://github.com/browserify/cipher-base/pull/23 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-9288 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-9287 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-9287 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4291-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cpq7-6gpm-g9rc · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10188 · Security Note
• https://osv.dev/vulnerability/DSA-5986-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-9287 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7746-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15484-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-9287 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9287 · Security Note
• https://osv.dev/vulnerability/GHSA-95m3-7q98-8xr5 · Vendor Advisory