CVE-2025-54799

描述

Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME client. Unlike the http-01 challenge which solves an ACME challenge over unencrypted HTTP, the ACME protocol requires HTTPS when a client communicates with the CA to performs ACME functions. However, the library fails to enforce HTTPS both in the original discover URL (configured by the library user) and in the subsequent addresses returned by the CAs in the directory and order objects. If users input HTTP URLs or CAs misconfigure endpoints, protocol operations occur over HTTP instead of HTTPS. This compromises privacy by exposing request/response details like account and request identifiers to network attackers. This was fixed in version 4.25.2.

如何修補 CVE-2025-54799

要修補 CVE-2025-54799,請將受影響套件升級到下列已修補版本。

—未列出修補版本
—未列出修補版本
—未列出修補版本
—升級至 4.25.2 或更新版本
—升級至 4.25.2 或更新版本

CVE-2025-54799 正在被利用嗎?

低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。

受影響套件(5)

from 0
from 0, <= 4.25.1
from 0, <= 4.25.1
from 0, < 4.25.2
from 0, < 4.25.2

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

描述

如何修補 CVE-2025-54799

CVE-2025-54799 正在被利用嗎?

受影響套件(5)

CVSS 分數

參考連結(5)