CVE-2025-47276 Details
Description
Actualizer is a single shell script solution to allow developers and embedded engineers to create Debian operating systems (OS). Prior to version 1.2.0, Actualizer uses OpenSSL's "-passwd" function, which uses SHA512 instead of a more suitable password hasher like Yescript/Argon2i. All Actualizer users building a full Debian Operating System are affected. Users should upgrade to version 1.2.0 of Actualizer. Existing OS deployment requires manual password changes against the alpha and root accounts. The change will deploy's Debian's yescript overriding the older SHA512 hash created by OpenSSL. As a workaround, users need to reset both `root` and "Alpha" users' passwords.
A vulnerability exists in Actualizer, a tool for creating Debian operating systems, prior to version 1.2.0. The issue arises because the application relies on OpenSSL's '-passwd' function, which uses SHA512 for password hashing. This is inappropriate, as a slower, more secure algorithm like Yescript or Argon2i should be used. All users of Actualizer who are building a full Debian operating system are affected. The vulnerability requires manual intervention to reset passwords for the 'alpha' and 'root' accounts after upgrading to version 1.2.0.
Users should upgrade to Actualizer version 1.2.0. After upgrading, it is necessary to manually reset the passwords for the 'alpha' and 'root' accounts to ensure they are hashed with the correct algorithm (Yescript), replacing the older SHA512 hashes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 13, 2025CISA-ADP
Assessed May 13, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html | [email protected] | |
| https://github.com/ChewKeanHo/Actualizer/commit/32c9cc232c856f078f8269fba80ce7562bbff86b | [email protected] | Source Code |
| https://github.com/ChewKeanHo/Actualizer/issues/1 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/ChewKeanHo/Actualizer/releases/tag/v1.2.0 | [email protected] | Release NotesVendor |
| https://github.com/ChewKeanHo/Actualizer/security/advisories/GHSA-v626-chv9-v9qr | [email protected] | AdvisoryRemedyVendor |
| https://github.com/openssl/openssl/issues/19340 | [email protected] | Issue TrackingVendor |
| https://www.reddit.com/r/debian/comments/1kknzqi/actualizer_v110_upgraded | [email protected] | Content WallVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-328 | Use of Weak Hash | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ChewKeanHo Actualizer | All versions |
CPE
Remediation
| |
| Debian | All versions |
CPE
Remediation
| |
| OpenSSL | < 1.1.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2025 | New CVE Received | [email protected] |