CVE-2025-65100 Security Snapshot May Use Unintended Timestamp When Only ISAR_APT_SNAPSHOT_DATE Is Set
Misconfiguration in Isar build system may cause missed security updates by using an unintended timestamp when specific variables are set.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-65100?
CVE-2025-65100 is a medium-severity vulnerability in ilbers isar, published on 19 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Isar is an integration system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining ISAR_APT_SNAPSHOT_DATE alone does not set the correct timestamp value for security distribution, leading to missed security updates. This issue has been patched via commit 738bcbb.
Weakness: CWE-693
Which versions are affected by CVE-2025-65100?
How do I fix CVE-2025-65100?
No fix has been published for CVE-2025-65100 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-65100 being exploited?
There is no known exploitation of CVE-2025-65100 in the wild and no public exploit code.
Sources
Also known as GHSA-3r9w-6cp6-7hm4.