openSUSE 16 Security Update : certbot (openSUSE-SU-2025-20074-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2025-20074-1 advisory. This update adds the certbot stack. python modules: ConfigArgParse, acme, certbot, certbot-nginx, josepy, pyRFC3339. Tenable has extracted the preceding...

OPENSUSE-SU-2025:20074-1 Security update for certbot

This update for certbot fixes the following issues: This update adds the certbot stack. python modules: ConfigArgParse, acme, certbot, certbot-nginx, josepy, pyRFC3339...

PT-2025-54862

This update for certbot fixes the following issues: This update adds the certbot stack. python modules: ConfigArgParse, acme, certbot, certbot-nginx, josepy, pyRFC3339...

Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves

Summary A vulnerability was identified in the evervault-go SDK’s attestation verification logic that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not meet expected integrity guarantees. The exploitability of this issue is...

Malicious code in @acme-types/acme-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1b754e0118dde98a24e6f1ea46eb2ed30d7b59cd938fbc627e6dc4429251482 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-36830

Malicious code in @acme-types/acme-package npm...

Malicious Package

Overview acme-package is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @acme-types/acme-package is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in acme-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b71a81b10d7836d7a4aeb72b36d2d7c0a4c94e7697d47254dc9c15ecd803bb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48972 Malicious code in acme-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b71a81b10d7836d7a4aeb72b36d2d7c0a4c94e7697d47254dc9c15ecd803bb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-36835

Malicious code in acme-package npm...

Fedora: Security Advisory (FEDORA-2025-30bf3a7b1a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MAL-2025-48787 Malicious code in acme-auth-utils (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in acme-auth-utils (npm)

--- -= Per source details. Do not edit below this line.=-...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the audit logging process. An attacker can obtain sensitive information by accessing improperly redacted HTTP request bodies recorded in audit logs. This may expose short-lived...

GHSA-GHFH-FMX4-26H8 OpenBao leaks HTTPRawBody in Audit Logs

Impact OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted HMAC'd. This impacted the following subsystems: - When using the ACME functionality of PKI, this would result in short-lived ACME verification challenge codes being leaked...

CVE-2025-62513

CVE-2025-62513 concerns OpenBao versions 2.2.0–2.4.1 where raw HTTP bodies were not redacted in the audit log, exposing ACME verification codes and OIDC/auth-related response data. The root cause is a logging regression affecting audit logs rather than a codepath in normal operation. The issue is...

CVE-2025-62513

OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted HMAC'd. This impacts those using the ACME functionality of PKI, resulting in...

CVE-2025-62513 OpenBao leaks HTTPRawBody in Audit Logs

OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted HMAC'd. This impacts those using the ACME functionality of PKI, resulting in...

CVE-2025-62513 OpenBao leaks HTTPRawBody in Audit Logs

OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted HMAC'd. This impacts those using the ACME functionality of PKI, resulting in...