Upstream information

CVE-2025-62513 at MITRE

Description

OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd). This impacts those using the ACME functionality of PKI, resulting in short-lived ACME verification challenge codes being leaked in the audit logs. Additionally, this impacts those using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use. This issue has been patched in OpenBao 2.4.2.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having important severity.

CVSS v3 Scores
CVSS detail National Vulnerability Database
Base Score 7.5
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact None
Availability Impact None
CVSSv3 Version 3.1
CVSS v4 Scores
CVSS detail CNA (GitHub)
Base Score 5.7
Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Attack Requirements Present
Privileges Required High
User Interaction Passive
Vulnerable System Confidentiality Impact High
Vulnerable System Integrity Impact None
Vulnerable System Availability Impact None
Subsequent System Confidentiality Impact None
Subsequent System Integrity Impact None
Subsequent System Availability Impact None
CVSSv4 Version 4.0
SUSE Bugzilla entry: 1252506 [NEW]

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
openSUSE Tumbleweed
  • openbao >= 2.4.3-1.1
  • openbao-agent >= 2.4.3-1.1
  • openbao-cassandra-database-plugin >= 2.4.3-1.1
  • openbao-influxdb-database-plugin >= 2.4.3-1.1
  • openbao-mysql-database-plugin >= 2.4.3-1.1
  • openbao-mysql-legacy-database-plugin >= 2.4.3-1.1
  • openbao-postgresql-database-plugin >= 2.4.3-1.1
  • openbao-server >= 2.4.3-1.1
 Patchnames:
openSUSE-Tumbleweed-2025-15663

SUSE Timeline for this CVE

CVE page created: Thu Oct 23 00:00:27 2025
CVE page last modified: Tue Oct 28 15:27:19 2025