Use of a broken or risky cryptographic algorithm in jose - CVE-2025-45767

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU114999

Use of a broken or risky cryptographic algorithm in jose - CVE-2025-45767

Published: September 9, 2025


Vulnerability identifier: #VU114999
CSH Severity: High
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-45767
CWE-ID: CWE-327
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to weak encryption. A remote attacker can gain unauthorized access to sensitive information on the system, potentially leading to a significant impact on data confidentiality.


Affected software

jose
Astronomer with IBM
watsonx Orchestrate Developer Edition
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
WatsonX BI Assistant
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
Event Streams

How to mitigate CVE-2025-45767

Install updates from vendor's website.

jose - update to 6.0.11
Astronomer with IBM - update to 1.0.1
watsonx Orchestrate Developer Edition - update to 1.13.0
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2.2
WatsonX BI Assistant - update to 5.2.1
Event Streams - update to 12.1.0
watsonx Assistant Cartridge - update to 5.3.0
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.3.0

External References

Related Security Bulletins