Detections
Analytics

Alpine: multiple openbao packages: security update to 2.4.3-r0

medium Tenable Cloud Security Plugin ID 435756

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's
 audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly
 redacted (HMAC'd). This impacts those using the ACME functionality of PKI, resulting in short-lived ACME
 verification challenge codes being leaked in the audit logs. Additionally, this impacts those using the
 OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could
 be leaked in the audit logs. ACME verification codes are not usable after verification or challenge expiry
 so are of limited long-term use. This issue has been patched in OpenBao 2.4.2. (CVE-2025-62513)

 - OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's
 audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters
 rather than strings. This includes, but is not limited to sys/raw with use of encoding=base64, all data
 would be emitted unredacted to the audit log, and Transit, when performing a signing operation with a
 derived Ed25519 key, would emit public keys to the audit log. This issue has been patched in OpenBao
 2.4.2. (CVE-2025-62705)

See Also

https://security.alpinelinux.org/vuln/CVE-2025-62513

https://security.alpinelinux.org/vuln/CVE-2025-62705

Plugin Details

Severity: Medium

ID: 435756

Version: Revision 1.9

Type: Local

Published: 10/23/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.94

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2025-62513

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.7

Threat Score: 1.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2025-62705

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/22/2025

Reference Information

CVE: CVE-2025-62513, CVE-2025-62705