`gh` is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to return a zero exit status when no attestations are present. This behavior is incorrect: When no attestations are present, `gh attestation verify` should return a non-zero exit status code, thereby signaling verification failure. An attacker can abuse this flaw to, for example, deploy malicious artifacts in any system that uses `gh attestation verify`'s exit codes to gatekeep deployments. Users are advised to update `gh` to patched version `v2.67.0` as soon as possible.

The version of gh installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-25204 advisory.

  - `gh` is GitHub's official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under     certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to     return a zero exit status when no attestations are present. This behavior is incorrect: When no     attestations are present, `gh attestation verify` should return a non-zero exit status code, thereby     signaling verification failure. An attacker can abuse this flaw to, for example, deploy malicious     artifacts in any system that uses `gh attestation verify`'s exit codes to gatekeep deployments. Users are     advised to update `gh` to patched version `v2.67.0` as soon as possible. (CVE-2025-25204)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - `gh` is GitHub's official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under     certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to     return a zero exit status when no attestations are present. This behavior is incorrect: When no     attestations are present, `gh attestation verify` should return a non-zero exit status code, thereby     signaling verification failure. An attacker can abuse this flaw to, for example, deploy malicious     artifacts in any system that uses `gh attestation verify`'s exit codes to gatekeep deployments. Users are     advised to update `gh` to patched version `v2.67.0` as soon as possible. (CVE-2025-25204)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - `gh` is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under
    certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to
    return a zero exit status when no attestations are present. This behavior is incorrect: When no
    attestations are present, `gh attestation verify` should return a non-zero exit status code, thereby
    signaling verification failure. An attacker can abuse this flaw to, for example, deploy malicious
    artifacts in any system that uses `gh attestation verify`'s exit codes to gatekeep deployments. Users are
    advised to update `gh` to patched version `v2.67.0` as soon as possible. (CVE-2025-25204)

ID	Name	Product	Family	Severity
295693	Azure Linux 3.0 Security Update: gh (CVE-2025-25204)	Nessus	Azure Linux Local Security Checks	medium
243632	Linux Distros Unpatched Vulnerability : CVE-2025-25204	Nessus	Misc.	medium
420901	SCA: security update for github.com/cli/cli/v2 (GHSA-fgw4-v983-mgp8)	Tenable Cloud Security	SCA Checks	medium
420901	SCA: security update for github.com/cli/cli/v2 (GHSA-fgw4-v983-mgp8)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2025-25204

medium

Tenable Plugins

medium

medium

medium

medium