Detections
Analytics

Alpine: multiple step-certificates packages: security update to 0.29.0-r0

critical Tenable Self-Hosted Container Security Plugin ID 436255

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create
 certificates without completing certain protocol authorization checks. (CVE-2025-44005)

 - Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior
 to 0.29.0, there is an improper authorization check for SSH certificate revocation. This affects
 deployments configured with the SSHPOP provisioner. This vulnerability is fixed in 0.29.0.
 (CVE-2025-66406)

See Also

https://security.alpinelinux.org/vuln/CVE-2025-44005

https://security.alpinelinux.org/vuln/CVE-2025-66406

Plugin Details

Severity: Critical

ID: 436255

Version: Revision 1.8

Type: Local

Published: 12/5/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.8

Percentile: 57.83

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2025-44005

CVSS v3

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 12/3/2025

Reference Information

CVE: CVE-2025-44005, CVE-2025-66406