Actualizer Uses OpenSSL's "-passwd" Function Which Uses SHA512 Under The Hood Instead of…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Actualizer is a single shell script solution to allow developers and embedded engineers to create Debian operating systems (OS). Prior to version 1.2.0, Actualizer uses OpenSSL's "-passwd" function, which uses SHA512 instead of a more suitable password hasher like Yescript/Argon2i. All Actualizer users building a full Debian Operating System are affected. Users should upgrade to version 1.2.0 of Actualizer. Existing OS deployment requires manual password changes against the alpha and root accounts. The change will deploy's Debian's yescript overriding the older SHA512 hash created by OpenSSL. As a workaround, users need to reset both `root` and "Alpha" users' passwords.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ChewKeanHo | Actualizer | before 1.2.0 | 1.2.0 | Patch available | CNA |
- Actualizer VendorChewKeanHo Affected before 1.2.0 Fixed in 1.2.0 Patch available CNA
Remediation
- Fix · CNA Actualizer (ChewKeanHo) Fixed in 1.2.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-47276
References
Other 7
- https://github.com/ChewKeanHo/Actualizer/security/advisories/GHSA-v626-chv9-v9qr
- https://github.com/ChewKeanHo/Actualizer/issues/1
- https://github.com/openssl/openssl/issues/19340
- https://github.com/ChewKeanHo/Actualizer/commit/32c9cc232c856f078f8269fba80ce7562bbff86b
- https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
- https://github.com/ChewKeanHo/Actualizer/releases/tag/v1.2.0
- https://www.reddit.com/r/debian/comments/1kknzqi/actualizer_v110_upgraded
More ChewKeanHo vulnerabilities
- TI-2026-58763 (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password… CVSS 3.1HIGH 7.9
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences