CVE-2025-53884

Upstream information

CVE-2025-53884 at MITRE

Description

NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of known passwords are precomputed).

---

Upstream Security Advisories:

• https://github.com/neuvector/neuvector/security/advisories/GHSA-8ff6-pc43-jwv3

SUSE information

Overall state of this security issue: Revisit

This issue is currently rated as having important severity.

CVSS v3 Scores

	CNA (SUSE)
Base Score	5.3
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality Impact	Low
Integrity Impact	None
Availability Impact	None
CVSSv3 Version	3.1

SUSE Bugzilla entry: 1247841 [NEW]

SUSE Security Advisories:

• GHSA-8ff6-pc43-jwv3, published Tue Aug 26 19:00:34 CEST 2025

List of released packages

Product(s)	Fixed package version(s)	References
openSUSE Tumbleweed	govulncheck-vulndb >= 0.0.20250908T141310-1.1	Patchnames: openSUSE-Tumbleweed-2025-15538

---

SUSE Timeline for this CVE

CVE page created: Fri Aug 8 16:30:24 2025
CVE page last modified: Wed Sep 17 19:31:36 2025