{"schema_version":"1.9.0","id":"CVE-2025-53884","published":"2025-09-17T12:27:03.128Z","modified":"2026-08-12T15:14:01.404116Z","aliases":["GHSA-8ff6-pc43-jwv3","GO-2025-3917"],"related":["CGA-p5j3-xrmp-mm2g","SUSE-SU-2025:03289-1","openSUSE-SU-2025:15538-1","openSUSE-SU-2026:21483-1"],"summary":"NeuVector has an  insecure password storage vulnerable to rainbow attack","details":"NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of known passwords are precomputed).","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/neuvector/neuvector","events":[{"introduced":"568356c9409989765e716c56a3caf87e4bba69ab"},{"fixed":"65d7e746ce84dbfeecde17f0f69ec16370b6e9db"}],"database_specific":{"extracted_events":[{"introduced":"5.0.0"},{"fixed":"5.4.6"}],"source":"AFFECTED_FIELD"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53884.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["262057388879917243189218491470984257527","14921899989987925630745045864773771899","39336313110153916292610461233912775615","322863322263352202393715665988828156123","333317758168122818203689769233219989536","145293007820601120448501876307783643629","205855968643439065789807805755472618390","71630680853029690589418460919674490123","69463341289600039050080627345162218089","191300362064051485058579562155928839556","211050457160173882409008987861322706250","251416315217988600183181041546450719320","8539180465425760721971263313424676338","176963135227364512382482193004657182656","79142855919862123745364460847322458251","193338223010979803713484758403234897801","73551890087876290532667204292784109503","33803175182917454481679449727217187662","90731773421309742073755169104766630837"],"threshold":0.9},"id":"CVE-2025-53884-4e62eb43","signature_type":"Line","signature_version":"v1","source":"https://github.com/neuvector/neuvector/commit/65d7e746ce84dbfeecde17f0f69ec16370b6e9db","target":{"file":"monitor/monitor.c"}},{"deprecated":false,"digest":{"function_hash":"66463032958626635395714349219418979035","length":10679},"id":"CVE-2025-53884-ecc896af","signature_type":"Function","signature_version":"v1","source":"https://github.com/neuvector/neuvector/commit/65d7e746ce84dbfeecde17f0f69ec16370b6e9db","target":{"file":"monitor/monitor.c","function":"fork_exec"}}],"vanir_signatures_modified":"2026-08-12T15:14:01Z"}}],"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53884.json"},{"type":"ADVISORY","url":"https://github.com/neuvector/neuvector/security/advisories/GHSA-8ff6-pc43-jwv3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53884"},{"type":"REPORT","url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53884"}],"database_specific":{"cna_assigner":"suse","cwe_ids":["CWE-759"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53884.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}