PT-2025-32239 · Go Acme+1 · Lego+1

Chrisnojima + 1 · Published 2025-08-06 · Updated 2025-08-19 · CVE-2025-54799

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Lego versions 4.25.1 and below

Description The github.com/go-acme/lego/v4/acme/api package, and consequently the Lego library and command-line interface, does not enforce HTTPS when communicating with Certificate Authorities (CAs) as an ACME client. The ACME protocol requires HTTPS for client-CA communication, but the library fails to enforce this requirement for both the initial discovery URL and subsequent addresses provided by CAs. This can lead to privacy compromises, as request and response details, including account and request identifiers, may be exposed to network attackers if HTTP URLs are used or if CAs misconfigure their endpoints.

Recommendations Lego versions prior to 4.25.2 are affected. Update to version 4.25.2 or later to resolve this issue.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2025-54799

GHSA-Q82R-2J7M-9RV4

GO-2025-3847

OPENSUSE-SU-2025:15434-1

SUSE-SU-2025:02912-1

Affected Products

Debian

Lego

References · 49

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54799.json · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2025:15434-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-54799 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-54799 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02912-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-54799 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54799 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-54799 · Security Note
• https://osv.dev/vulnerability/GO-2025-3847 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-54799 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54799 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q82r-2j7m-9rv4 · Vendor Advisory
• https://github.com/go-acme/lego · Note
• https://github.com/go-acme/lego/security/advisories/GHSA-q82r-2j7m-9rv4 · Note
• https://github.com/go-acme/lego/commit/238454b5f74f3cfcbb244ff0d0dc914a4ad44b96 · Note