|
|
|
| Date
|
2026-07-17
|
| Severity
|
reported "high", BlueSpice assessment: not affected
|
| Affected
|
bluespice/search Docker image (all versions)
bluespice/ai Docker image (5.3.x)
|
| Fixed in
|
Unknown
|
| CVE
|
|
Problem
| CVE
|
Component
|
Type of vulnerability
|
BlueSpice 5
|
| CVE-2025-14813
|
bluespice/search
|
Use of a Broken or Risky Cryptographic Algorithm
|
not affected
|
| CVE-2025-65896
|
bluespice/ai
|
SQL Injection via dictionary as params
|
not affected
|
Impact assessment
| CVE
|
Assessment
|
Mitigation without update
|
| CVE-2025-14813
|
The code is only used by Tika when processing Encrypted PDFs and Office files, which we don't support. In addition the code affected in particular is probably not used and the described attack vector ("capture ciphertext") and impact ("perform cryptanalysis and uncover the underlying data") is not applicable in this use case.
|
No action required.
|
| CVE-2025-65896
|
Asyncmy is only used as the DB API layer for SQLAlchemy to connect to MySQL, SQLAlchemy enforces a "format" parameter style, which only uses "%s" placeholder strings for SQL queries. This is opposed to inserting values via a dictionary, meaning no impact from this CVE is possible.
|
No action required.
|
Solution
No immediate action required.
