CVE-2025-41256

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-41256
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-41256.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-41256
Aliases
  • GHSA-688c-vjrc-84rv
Published
2025-06-25T09:16:58.586Z
Modified
2026-07-15T01:49:09.897138372Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Cyberduck and Mountain Duck - Weak Hash Algorithm for Certificate Fingerprint
Details

Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e.g., self-signed), since the certificate fingerprint is stored as SHA-1, although SHA-1 is considered weak.

This issue affects Cyberduck: through 9.1.6; Mountain Duck: through 4.17.5.

Database specific 
{
    "cna_assigner": "sba-research",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/41xxx/CVE-2025-41256.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "last_affected": "4.17.5"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-328"
    ]
}
References

Affected packages

Git / github.com/iterate-ch/cyberduck

Affected ranges

Type
GIT
Repo
https://github.com/iterate-ch/cyberduck
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
53bf5bba71249806e3fe4dec04be6db3a15355b0
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.1.6"
        },
        {
            "fixed": "9.1.6"
        }
    ]
}

Affected versions

Other
$TAG_NAME
release-3-3
release-3-3-1
release-3-3-beta1
release-3-3-beta2
release-3-3-beta3
release-3-3-beta4
release-3-4
release-3-4-1
release-3-4-2
release-3-5
release-3-5-1
release-3-6
release-3-6-1
release-3-7
release-3-8
release-3-8-1
release-4-0
release-4-0-1
release-4-0-2
release-4-1
release-4-1-1
release-4-1-2
release-4-1-3
release-4-2
release-4-2-1
release-4-3
release-4-4
release-4-4-1
release-4-4-2
release-4-4-3
release-4-4-4
release-4-5
release-4-5-1
release-4-5-2
release-4-6
release-4-6-1
release-4-6-2
release-4-6-3
release-4-6-4
release-4-6-5
release-4-7
release-4-7-1
release-4-7-2
release-4-7-3
release-4-7-4
release-4-7-5
release-4-7-6
release-4-7-7
release-4-8
release-4-8-1
release-4-8-2
release-4-8-3
release-5-0
release-5-0-1
release-5-0-10
release-5-0-11
release-5-0-12
release-5-0-13
release-5-0-14
release-5-0-2
release-5-0-3
release-5-0-4
release-5-0-5
release-5-0-6
release-5-0-7
release-5-0-8
release-5-0-9
release-5-1-0
release-5-1-1
release-5-2-0
release-5-2-1
release-5-2-2
release-5-2-3
release-5-3-0
release-5-3-1
release-5-3-2
release-5-3-3
release-5-3-4
release-5-3-5
release-5-3-6
release-6-0-1
release-6-0-2
release-6-0-3
release-6-1-0
release-6-2-0
release-6-2-1
release-6-2-10
release-6-2-11
release-6-2-2
release-6-2-3
release-6-2-4
release-6-2-5
release-6-2-6
release-6-2-7
release-6-2-8
release-6-2-9
release-6-3-0
release-6-3-1
release-6-3-2
release-6-3-3
release-6-3-4
release-6-3-5
release-6-4-0
release-6-4-1
release-6-4-2
release-6-4-3
release-6-4-4
release-6-4-5
release-6-4-6
release-6-5-0
release-6-6-0
release-6-6-1
release-6-6-2
release-6-7-0
release-6-7-1
release-6-7-2
release-6-8-0
release-6-8-1
release-6-8-2
release-6-8-3
release-6-8-4
release-6-9-0
release-6-9-1
release-6-9-10
release-6-9-11
release-6-9-12
release-6-9-2
release-6-9-3
release-6-9-4
release-6-9-5
release-6-9-6
release-6-9-7
release-6-9-8
release-6-9-9
release-7-0-0
release-7-0-1
release-7-0-2
release-7-0-3
release-7-1-0
release-7-1-1
release-7-1-2
release-7-10-0
release-7-10-1
release-7-10-2
release-7-2-2
release-7-2-3
release-7-2-4
release-7-2-5
release-7-2-6
release-7-2-7
release-7-3-0
release-7-3-1
release-7-4-0
release-7-4-1
release-7-4-2
release-7-4-3
release-7-5-0
release-7-5-1
release-7-5-2
release-7-6-0
release-7-6-1
release-7-6-2
release-7-6-3
release-7-6-4
release-7-6-5
release-7-7-0
release-7-7-1
release-7-7-2
release-7-8-0
release-7-8-1
release-7-8-2
release-7-8-3
release-7-8-4
release-7-8-5
release-7-9-0
release-7-9-1
release-7-9-2
release-7-9-3
release-8-0-0
release-8-0-1
release-8-1-0
release-8-1-1
release-8-1-2
release-8-2-0
release-8-2-1
release-8-2-2
release-8-2-3
release-8-3-0
release-8-3-1
release-8-3-2
release-8-3-3
release-8-4-0
release-8-4-1
release-8-4-2
release-8-4-3
release-8-4-4
release-8-4-5
release-8-5-0
release-8-5-1
release-8-5-2
release-8-5-3
release-8-5-4
release-8-5-5
release-8-5-6
release-8-5-7
release-8-5-8
release-8-5-9
release-8-6-0
release-8-6-1
release-8-6-2
release-8-7-0
release-8-7-1
release-8-7-2
release-8-7-3
release-8-8-0
release-8-8-1
release-8-8-2
release-8-9-0
release-9-0-0
release-9-0-1
release-9-0-2
release-9-1-0
release-9-1-1
release-9-1-2
release-9-1-3
release-9-1-4
release-9-1-5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-41256.json"