GHSA-wc9m-r3v6-9p5h
Sparkle Signing Checks Bypass
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| SwiftURL | github.com/sparkle-project/Sparkle | < 2.6.4 | 2.6.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.
References
External links from the advisory. They lead to third-party sites.