Upstream information

CVE-2025-25204 at MITRE

Description

`gh` is GitHub's official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to return a zero exit status when no attestations are present. This behavior is incorrect: When no attestations are present, `gh attestation verify` should return a non-zero exit status code, thereby signaling verification failure. An attacker can abuse this flaw to, for example, deploy malicious artifacts in any system that uses `gh attestation verify`'s exit codes to gatekeep deployments. Users are advised to update `gh` to patched version `v2.67.0` as soon as possible.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v3 Scores
CVSS detail CNA (GitHub)
Base Score 6.3
Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality Impact None
Integrity Impact High
Availability Impact None
CVSSv3 Version 3.1
No SUSE Bugzilla entries cross referenced.

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
Container suse/sl-micro/6.0/baremetal-os-container:latest
Container suse/sl-micro/6.0/base-os-container:latest
Container suse/sl-micro/6.0/kvm-os-container:latest
Container suse/sl-micro/6.0/rt-os-container:latest
Container suse/sl-micro/6.0/toolbox:latest
  • libxml2-2 >= 2.11.6-3.1
Image SL-Micro-Base
Image SL-Micro-Base-RT
Image SL-Micro-Base-RT-SelfInstall
Image SL-Micro-Base-RT-encrypted
Image SL-Micro-Base-SelfInstall
Image SL-Micro-Base-encrypted
Image SL-Micro-Base-qcow
Image SL-Micro-Default
Image SL-Micro-Default-SelfInstall
Image SL-Micro-Default-encrypted
Image SL-Micro-Default-qcow
  • update-alternatives >= 1.22.0-slfo.1.1_2.1
Image SL-Micro
  • libxml2-2 >= 2.11.6-3.1
  • update-alternatives >= 1.22.0-slfo.1.1_2.1
Image SLE-Micro
Image SLE-Micro-Azure
Image SLE-Micro-BYOS
Image SLE-Micro-BYOS-Azure
Image SLE-Micro-BYOS-EC2
Image SLE-Micro-BYOS-GCE
Image SLE-Micro-EC2
Image SLE-Micro-GCE
  • libxml2-2 >= 2.11.6-3.1
  • libxml2-tools >= 2.11.6-3.1
  • update-alternatives >= 1.22.0-slfo.1.1_2.1
SUSE Linux Enterprise Server 16.0
  • govulncheck-vulndb >= 0.0.20250814T182633-160000.1.2
 Patchnames:
SUSE Linux Enterprise Server 16.0 GA govulncheck-vulndb-0.0.20250814T182633-160000.1.2
openSUSE Tumbleweed
  • govulncheck-vulndb >= 0.0.20250312T181707-1.1
 Patchnames:
openSUSE-Tumbleweed-2025-14889

SUSE Timeline for this CVE

CVE page created: Fri Feb 14 20:00:29 2025
CVE page last modified: Sat Nov 8 22:34:26 2025