Detections
Analytics

Alpine: multiple go packages: security update to 1.25.7-r0

critical Tenable Self-Hosted Container Security Plugin ID 437570

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting
 cgo binary. (CVE-2025-61732)

 - During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields
 mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it
 should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or
 uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would
 not have resumed with during the initial handshake, or cause a server to resume a session with a client
 that it would not have resumed with during the initial handshake. (CVE-2025-68121)

See Also

https://security.alpinelinux.org/vuln/CVE-2025-61732

https://security.alpinelinux.org/vuln/CVE-2025-68121

Plugin Details

Severity: Critical

ID: 437570

Version: Revision 1.7

Type: Local

Published: 2/5/2026

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7

Percentile: 98.3

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-68121

CVSS v3

Risk Factor: Critical

Base Score: 10

Temporal Score: 9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 1/22/2026

Reference Information

CVE: CVE-2025-61732, CVE-2025-68121

IAVB: 2026-B-0016