CVE-2025-25204

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2025-25204

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-25204.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-25204

Aliases

Related

Withdrawn

2025-02-19T09:48:41.784291Z

Published

2025-02-14T17:15:19Z

Modified

2025-03-03T19:41:53.874745Z

Downstream

openSUSE-SU-2025:14889-1

Summary

[none]

Details

gh is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool gh attestation verify causes it to return a zero exit status when no attestations are present. This behavior is incorrect: When no attestations are present, gh attestation verify should return a non-zero exit status code, thereby signaling verification failure. An attacker can abuse this flaw to, for example, deploy malicious artifacts in any system that uses gh attestation verify's exit codes to gatekeep deployments. Users are advised to update gh to patched version v2.67.0 as soon as possible.

References

Affected packages

Debian:12 / gh

Package

Name: gh
Purl: pkg:deb/debian/gh?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.23.0+dfsg1-1

2.24.3+dfsg1-1

2.27.0+dfsg1-1

2.30.0-1

2.30.0-2

2.35.0-1

2.40.1+dfsg1-1

2.42.1-1

2.43.1-1

2.44.1-1

2.44.1-2

2.45.0-1

2.46.0-1

2.46.0-2

2.46.0-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / gh