Detections
Analytics

Alpine: multiple go packages: security update to 1.24.6-r0

high Tenable Cloud Security Plugin ID 432632

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs
 when possibly dangerous VCS configuration is present in repositories. This can happen when a repository
 was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which
 are retrieved using the go command line, i.e. via "go get", are not affected. (CVE-2025-4674)

 - If the PATH environment variable contains paths which are executables (rather than just directories),
 passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH
 being unexpectedly returned. (CVE-2025-47906)

 - Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to
 the Scan method of the returned Rows can result in unexpected results if other queries are being made in
 parallel. This can result in a race condition that may overwrite the expected results with those of
 another query, causing the call to Scan to return either unexpected results from the other query or an
 error. (CVE-2025-47907)

See Also

https://security.alpinelinux.org/vuln/CVE-2025-4674

https://security.alpinelinux.org/vuln/CVE-2025-47906

https://security.alpinelinux.org/vuln/CVE-2025-47907

Plugin Details

Severity: High

ID: 432632

Version: Revision 1.17

Type: Local

Published: 8/8/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.39

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-4674

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 7.7

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 7/10/2025

Reference Information

CVE: CVE-2025-4674, CVE-2025-47906, CVE-2025-47907

IAVB: 2025-B-0108-S, 2025-B-0136-S