Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Fedora 42: 2025-96ff8c2897 important: yarnpkg pbkdf2 key material

fedora
Calendar Grey July 4, 2025
Dist Fedora Esm H88
Significant update for yarnpkg in Fedora 42 bolsters scrypt encryption library protection, addressing multiple security flaws.
Update bundled pbkdf2 library.

Summary

Fast, reliable, and secure dependency management.

Update Information:

Update bundled pbkdf2 library.

Topics%20covered

Topics Covered

security advisory fedora security fix important dependency management pbkdf2

Change Log

* Tue Jun 24 2025 Sandro Mani - 1.22.22-9 - Add CVE-2025-6545_6547.prebundle.patch and regenerate bundle. Fixes CVE-2025-6545 and CVE-2025-6547.

References


[ 1 ] Bug #2374429 - CVE-2025-6547 yarnpkg: pbkdf2 silently returns static keys [epel-8] https://bugzilla.redhat.com/show_bug.cgi?id=2374429 [ 2 ] Bug #2374433 - CVE-2025-6545 yarnpkg: pbkdf2 silently returns predictable key material [epel-8] https://bugzilla.redhat.com/show_bug.cgi?id=2374433 [ 3 ] Bug #2374438 - CVE-2025-6547 yarnpkg: pbkdf2 silently returns static keys [epel-9] https://bugzilla.redhat.com/show_bug.cgi?id=2374438 [ 4 ] Bug #2374443 - CVE-2025-6545 yarnpkg: pbkdf2 silently returns predictable key material [epel-9] https://bugzilla.redhat.com/show_bug.cgi?id=2374443 [ 5 ] Bug #2374450 - CVE-2025-6547 yarnpkg: pbkdf2 silently returns static keys [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2374450 [ 6 ] Bug #2374455 - CVE-2025-6545 yarnpkg: pbkdf2 silently returns predictable key material [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2374455 [ 7 ] Bug #2374462 - CVE-2025-65...

Read the Full Advisory

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-96ff8c2897' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
important
Lowest
Low
Medium
High
Critical

Name: yarnpkg
Product: Fedora 42
Version: 1.22.22
Release: 9.fc42
URL: https://github.com/yarnpkg/yarn
Summary: Fast, reliable, and secure dependency management.

Topics%20covered

Topics Covered

security advisory fedora security fix important dependency management pbkdf2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here