CVE-2025-62513
OpenBao leaks HTTPRawBody in Audit Logs
Impact
### Impact OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd). This impacted the following subsystems: - When using the ACME functionality of PKI, this would result in short-lived ACME verification challenge codes being leaked in the audit logs. - When using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs. Third-party plugins may be affected. ### Patches OpenBao v2.4.2 will patch this issue. ### Workarounds If users do not use the above functionality, they are not impacted. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/openbao/openbao | >= 0.0.0-20241114205727-b1235e585db7, < 0.0.0-20251022165510-cc2c476bac66 | 0.0.0-20251022165510-cc2c476bac66 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openbao | Openbao | from 2.2.0 before 2.4.2 |