GHSA-rc54-2g2c-g36g

Source

https://github.com/advisories/GHSA-rc54-2g2c-g36g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-rc54-2g2c-g36g/GHSA-rc54-2g2c-g36g.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rc54-2g2c-g36g

Aliases

CVE-2025-62705

Published

2025-10-22T19:55:40Z

Modified

2025-10-23T17:40:56Z

Severity

5.7 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

OpenBao and Vault Leak []byte Fields in Audit Logs

Details

Impact

OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to:

sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log.
Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log.

Third-party plugins may be affected.

This issue has been present since HashiCorp Vault and continues to impact Vault as of v1.20.4.

Patches

OpenBao v2.4.2 will patch this issue.

Workarounds

If users do not use the above functionality, they are not impacted. To prohibit the use of sys/raw globally, ensure raw_storage_endpoint=false is set or missing from the server configuration.

Database specific

{
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-532"
    ],
    "nvd_published_at": "2025-10-22T22:15:35Z",
    "github_reviewed_at": "2025-10-22T19:55:40Z"
}

References

Affected packages

Go / github.com/openbao/openbao

Package

Name: github.com/openbao/openbao; View open source insights on deps.dev
Purl: pkg:golang/github.com/openbao/openbao

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20251022165510-cc2c476bac66