CVE-2025-65100

Isar is an integration system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining ISAR_APT_SNAPSHOT_DATE alone does not set the correct timestamp value for security distribution, leading to missed security updates. This issue has been patched via commit 738bcbb.

CVSS

No CVSS.

References

Link	Resource
https://github.com/ilbers/isar/commit/3383fd808a4ced93e41e012660dfe364a3384434
https://github.com/ilbers/isar/commit/738bcbb716c7eb7b34cbb2293cae4f264b3925fe
https://github.com/ilbers/isar/security/advisories/GHSA-3r9w-6cp6-7hm4

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Isar es un sistema de integración para la generación automatizada de sistemas de archivos raíz. En las versiones 0.11-rc1 y 0.11, definir ISAR_APT_SNAPSHOT_DATE por sí solo no establece el valor de marca de tiempo correcto para la distribución de seguridad, lo que lleva a la pérdida de actualizaciones de seguridad. Este problema ha sido parcheado mediante el commit 738bcbb.

Information

Published : 2025-11-19 19:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-65100

Mitre link : CVE-2025-65100

CVE.ORG link : CVE-2025-65100

JSON object : View

Products Affected

No product.

CWE

CWE-693

Protection Mechanism Failure

{"id": "CVE-2025-65100", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65100", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T20:27:01.525384Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ilbers", "product": "isar", "versions": [{"status": "affected", "version": "< 738bcbb716c7eb7b34cbb2293cae4f264b3925fe"}]}]}], "published": "2025-11-19T19:15:50.837", "references": [{"url": "https://github.com/ilbers/isar/commit/3383fd808a4ced93e41e012660dfe364a3384434", "source": "security-advisories@github.com"}, {"url": "https://github.com/ilbers/isar/commit/738bcbb716c7eb7b34cbb2293cae4f264b3925fe", "source": "security-advisories@github.com"}, {"url": "https://github.com/ilbers/isar/security/advisories/GHSA-3r9w-6cp6-7hm4", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "Isar is an integration system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining ISAR_APT_SNAPSHOT_DATE alone does not set the correct timestamp value for security distribution, leading to missed security updates. This issue has been patched via commit 738bcbb."}, {"lang": "es", "value": "Isar es un sistema de integraci\u00f3n para la generaci\u00f3n automatizada de sistemas de archivos ra\u00edz. En las versiones 0.11-rc1 y 0.11, definir ISAR_APT_SNAPSHOT_DATE por s\u00ed solo no establece el valor de marca de tiempo correcto para la distribuci\u00f3n de seguridad, lo que lleva a la p\u00e9rdida de actualizaciones de seguridad. Este problema ha sido parcheado mediante el commit 738bcbb."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "security-advisories@github.com"}