Detections
Analytics
SCA: security update for github.com/edgelesssys/constellation/v2 (GHSA-hq76-6gh2-5g4q)
high Tenable Self-Hosted Container Security Plugin ID 435800
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Constellation is the first Confidential Kubernetes. The Constellation CVM image uses LUKS2-encrypted
volumes for persistent storage. When opening an encrypted storage device, the CVM uses the libcryptsetup
function crypt_activate_by_passhrase. If the VM is successful in opening the partition with the disk
encryption key, it treats the volume as confidential. However, due to the unsafe handling of null keyslot
algorithms in the cryptsetup 2.8.1, it is possible that the opened volume is not encrypted at all.
Cryptsetup prior to version 2.8.1 does not report an error when processing LUKS2-formatted disks that use
the cipher_null-ecb algorithm in the keyslot encryption field. This vulnerability is fixed in 2.24.0.
(CVE-2025-58356)
See Also
Plugin Details
Severity: High
ID: 435800
Version: Revision 1.16
Type: Local
Family: SCA Checks
Published: 10/27/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.51
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2025-58356
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.3
Threat Score: 5.6
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/27/2025
Vulnerability Publication Date: 10/27/2025
Reference Information
CVE: CVE-2025-58356