Skip to content
OpenAdvisories
Medium WID-SEC-2025-2391 3 CVEs

OpenBao: Mehrere Schwachstellen

Published Oct 22, 2025 · Updated Oct 26, 2025 · Revision 3 · de-DE

Vendor: Fedora Vendor: SUSE Product: Linux Product: openSUSE Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um Informationen offenzulegen, und um einen Denial of Service Angriff durchzuführen.

Product

OpenBao ist eine Open-Source-Lösung für Secrets Management, die sensible Daten wie Passwörter, API-Schlüssel und Zertifikate sicher speichert und verwaltet.

Vulnerabilities 3

  • High 7.5
    CVE-2025-59043

    OpenBao vulnerable to denial of service via malicious JSON request processing

    OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significantly more memory than their serialized version. It is possible to craft a JSON payload to maximize the factor …

    openbao openbao github.com/openbao/openbao openbao Alpine Go
  • Medium 5.7
    CVE-2025-62513

    OpenBao leaks HTTPRawBody in Audit Logs

    OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd). This impacts those using the ACME …

    openbao openbao github.com/openbao/openbao openbao Alpine Go
  • Medium 5.7
    CVE-2025-62705

    OpenBao and Vault Leak []byte Fields in Audit Logs

    OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited…

    openbao openbao github.com/openbao/openbao openbao Alpine Go

Revision history

  1. #3

    Neue Updates von openSUSE aufgenommen

  2. #2

    Neue Updates von Fedora aufgenommen

  3. #1

    Initiale Fassung

References