Security Bulletin: Impacted IBM optim (spark) 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in packages github.com/smallstep/certificates

Summary Impacted IBM optim spark 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in packages github.com/smallstep/certificates. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2025-44005 DESCRIPTION: An...

GO-2026-5297 Step CA affected by an index out of bounds panic in TPM attestation EKU validation in github.com/smallstep/certificates

Step CA affected by an index out of bounds panic in TPM attestation EKU validation in github.com/smallstep/certificates...

Authorization Bypass

github.com/smallstep/certificates is vulnerable to Authorization Bypass. The vulnerability is due to improper enforcement of protocol authorization checks, which allows an attacker to bypass validation steps and obtain certificates without proper authorization...

GO-2026-4775 step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) in github.com/smallstep/certificates

step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq MessageType=18 in github.com/smallstep/certificates...

Improper Authentication

github.com/smallstep/certificates is vulnerable to improper authentication. The vulnerability is due to missing safeguards against unauthenticated certificate issuance through the SCEP UpdateReq, which allows an attacker to obtain certificates without authentication...

GO-2025-4181 step-ca Has Improper Authorization Check for SSH Certificate Revocation in github.com/smallstep/certificates

step-ca Has Improper Authorization Check for SSH Certificate Revocation in github.com/smallstep/certificates...