Tóm tắt nhanh
- CVE-2025-62705 là lỗ hổng mức TRUNG BÌNH (CVSS 4.9) ảnh hưởng github.com/openbao/openbao, openbao (openbao).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.33%, cao hơn 26.3% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 0.0.0-20251022165510-cc2c476bac66, 2.4.2 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| github.com/openbao/openbao Go | < 0.0.0-20251022165510-cc2c476bac66
| 0.0.0-20251022165510-cc2c476bac66
|
| openbao | < 2.4.2
| 2.4.2
|
Mô tả
Impact
OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to:
sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log.- Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log.
Third-party plugins may be affected.
This issue has been present since HashiCorp Vault and continues to impact Vault as of v1.20.4.
Patches
OpenBao v2.4.2 will patch this issue.
Workarounds
If users do not use the above functionality, they are not impacted. To prohibit the use of sys/raw globally, ensure raw_storage_endpoint=false is set or missing from the server configuration.
Mô tả của NVD
OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log, and Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log. This issue has been patched in OpenBao 2.4.2.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí