Ubuntu alert USN-8452-1 (node-pbkdf2)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8452-1] pbkdf2 vulnerability
Date:
             
 
Thu, 25 Jun 2026 14:30:31 +0000
Message-ID:
             
 
<E1wcl67-0000R9-0v@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8452-1
June 18, 2026

node-pbkdf2 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS

Summary:

pbkdf2 could be made to generate predictable cryptographic keys if it received specially crafted
input.

Software Description:
- node-pbkdf2: PBKDF2 with any supported hashing algorithm in Node

Details:

Nikita Skovoroda discovered that pbkdf2 did not properly validate
certain algorithm names. An attacker could possibly use this issue to
generate predictable cryptographic keys, resulting in signature spoofing.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
  node-pbkdf2                     3.1.2-3ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 22.04 LTS
  node-pbkdf2                     3.1.2-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  node-pbkdf2                     3.0.16-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  node-pbkdf2                     3.0.14-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8452-1
  CVE-2025-6545


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmo0OvgACgkQcpJm3tlz
hgG61A//WuEnp2V20dIAt4caCOqr/4x4v0iPQpIiA86O3hYWRHWjUlY5ffohVNp2
2NyG9CwacEz8EndyTmjVhBK9iA0/1MJ3R7nUxq+t+dFyfMMdbnwOC5lu93iin10q
xhsRHsZdfHDTFRQ+D/hTcPBTiZrsvq/psgNfJRmVFlNwMBEA3Z4axghh+/bO6Q+W
eibJexfsdTKTkkVcIcVlA/w3hliV/4bRqxlqipv0mi4gk92OOzKIQBtGg3uKVuwP
rz7qRbY1K/JFaDkZrr9qhTsScxeLk31VgssC3wV2CgXYrQeb1O6v0j6gCp4FMOU7
jrZple6kHlFXqvC1QcwlgYzoyijBLwqzoCxgBC09rVE2/v5kOhaNXQf8X+79kdYi
D9MiqCNKIF73ZUX4sywZLD0BOl+ZnKAMgvyjR8tdJ98dAIseU/tGMCopwSSYjkk2
O/XdGLWdIEH8hNherAjOrRYVRkbQZhHp7+mARUTeBmfU+UK2e6vS2m7tKYDaFQt/
bdQCTCOaXat9d0Mh7A+1YEMNr5DO3gLDYzE3eQn4+zsr8+si/0zBj+9jlU0aMjJr
KBCT8/6geSrerN1JoS5pi2JdITbRHXzXJ2xkWkOY/6/GmmKxdWnZ0JxoTLuUTcEs
JY/QrEOE/+eGh3tpE8Ou03MQBtwvwIOSltSo7akmah4Bmy4vwow=
=WeXd
-----END PGP SIGNATURE-----