Detections
Analytics

Alpine: multiple openbao packages: security update to 2.3.1-r0

medium Tenable Self-Hosted Container Security Plugin ID 428371

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including
 secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when
 processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has
 been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to
 ensure properly formatted requests from all clients. (CVE-2025-52893)

 - OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including
 secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated,
 unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service. In
 OpenBao v2.2.0 and later, manually setting the configuration option
 `disable_unauthed_rekey_endpoints=true` allows an operator to deny these rarely-used endpoints on global
 listeners. A patch is available at commit fe75468822a22a88318c6079425357a02ae5b77b. In a future OpenBao
 release communicated on OpenBao's website, the maintainers will set this to `true` for all users and
 provide an authenticated alternative. As a workaround, if an active proxy or load balancer sits in front
 of OpenBao, an operator can deny requests to these endpoints from unauthorized IP ranges. (CVE-2025-52894)

See Also

https://security.alpinelinux.org/vuln/CVE-2025-52893

https://security.alpinelinux.org/vuln/CVE-2025-52894

Plugin Details

Severity: Medium

ID: 428371

Version: Revision 1.13

Type: Local

Published: 7/13/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2025-52894

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/25/2025

Reference Information

CVE: CVE-2025-52893, CVE-2025-52894