PT-2025-47518 · Isar · Isar

Published 2025-11-19 · Updated 2025-11-21 · CVE-2025-65100

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Isar versions 0.11-rc1 through 0.11

Description Isar is a system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining the ISAR APT SNAPSHOT DATE variable alone does not correctly set the timestamp value for security distribution. This can result in missed security updates.

Recommendations Update to a version after the commit 738bcbb to address this issue.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2025-65100

GHSA-3R9W-6CP6-7HM4

Affected Products

Isar

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65100.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-65100 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65100 · Security Note
• https://github.com/ilbers/isar/commit/3383fd808a4ced93e41e012660dfe364a3384434 · Note
• https://github.com/ilbers/isar/security/advisories/GHSA-3r9w-6cp6-7hm4 · Note
• https://github.com/ilbers/isar/commit/738bcbb716c7eb7b34cbb2293cae4f264b3925fe · Note
• https://t.me/cveNotify/143574 · Telegram Post
• https://t.me/CVEtracker/37777 · Telegram Post
• https://twitter.com/CVEnew/status/1991409469473849420 · Twitter Post