CVE-2025-47276

Actualizer is a single shell script solution to allow developers and embedded engineers to create Debian operating systems (OS). Prior to version 1.2.0, Actualizer uses OpenSSL's "-passwd" function, which uses SHA512 instead of a more suitable password hasher like Yescript/Argon2i. All Actualizer users building a full Debian Operating System are affected. Users should upgrade to version 1.2.0 of Actualizer. Existing OS deployment requires manual password changes against the alpha and root accounts. The change will deploy's Debian's yescript overriding the older SHA512 hash created by OpenSSL. As a workaround, users need to reset both `root` and "Alpha" users' passwords.

• CWE-328

• https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
• https://github.com/ChewKeanHo/Actualizer/commit/32c9cc232c856f078f8269fba80ce7562bbff86b
• https://github.com/ChewKeanHo/Actualizer/issues/1
• https://github.com/ChewKeanHo/Actualizer/releases/tag/v1.2.0
• https://github.com/ChewKeanHo/Actualizer/security/advisories/GHSA-v626-chv9-v9qr
• https://github.com/openssl/openssl/issues/19340
• https://www.reddit.com/r/debian/comments/1kknzqi/actualizer_v110_upgraded

Published

May 13, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-47270nimiq/core-rs-albatross is a Rust implementation of the Nimi…7.5
• CVE-2025-47271The OZI action is a GitHub Action that publishes releases to…6.3
• CVE-2025-47272The CE Phoenix eCommerce platform, starting in version 1.0.9…5.5
• CVE-2025-47273setuptools is a package that allows users to download, build…8.8
• CVE-2025-47274ToolHive is a utility designed to simplify the deployment an…2.4
• CVE-2025-47275Auth0-PHP provides the PHP SDK for Auth0 Authentication and …9.1
• CVE-2025-47277vLLM, an inference and serving engine for large language mod…9.8
• CVE-2025-47278Flask is a web server gateway interface (WSGI) web applicati…1.8
• CVE-2025-47279Undici is an HTTP/1.1 client for Node.js. Prior to versions …3.1
• CVE-2025-4728A vulnerability was found in SourceCodester Best Online News…9.8
• CVE-2025-47280Umbraco Forms is a form builder that integrates with the Umb…6.1
• CVE-2025-47281Kyverno is a policy engine designed for cloud native platfor…7.7