org.webjars.npm:ethereum-cryptography (0.1.3), org.webjars.npm:parse-asn1 (>=5.0.0, <=5.1.6) potentially affected by CVE-2025-6545 via org.webjars.npm:pbkdf2 (3.1.2)

🗓️ 23 Jun 2025 22:41:50Reported by Vulners OSVType

vulnersosv🔗 security.snyk.io👁 2 Views

pbkdf2 3.1.2 affected by CVE-2025-6545; ethereum-cryptography and parse-asn1 transitively impacted.

Reporter	Title	Published	Views	Family All 52
IBM Security Bulletins	Security Bulletin: Vulnerabilities in pbkdf2 affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Sep 202511:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in pbkdf2 affect IBM Decision Optimization for IBM Cloud Pak for Data (CVE-2025-6545 and CVE-2025-6547)	3 Sep 202508:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container Dashboard operands are vulnerable to loss of confidentiality [CVE-2025-6545] [CVE-2025-6547]	26 Jun 202516:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in pbkdf2-3.1.2.tgz	22 Oct 202511:24	–	ibm
BDU FSTEC	The vulnerability of the pbkdf2 library in the Node.js software platform, which allows attackers to forge digital signatures	25 Jun 202500:00	–	bdu_fstec
Chainguard	CVE-2025-6545 vulnerabilities	3 Jul 202620:22	–	cgr
Circl	CVE-2025-6545	23 Jun 202518:45	–	circl
CNNVD	Browserify pbkdf2 安全漏洞	23 Jun 202500:00	–	cnnvd
CVE	CVE-2025-6545	23 Jun 202518:41	–	cve
Cvelist	CVE-2025-6545 pbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js	23 Jun 202518:41	–	cvelist

24 Oct 2025 17:42Current

5.3Medium risk

Vulners AI Score5.3

CVSS 49.1

EPSS0.00392

SSVC

pbkdf2 CVE-2025-6545 ethereum-cryptography parse-asn1 transitive dependency Maven