PT-2025-7058 · Github · Gh

Bagtoad · Published 2025-02-14 · Updated 2025-03-13 · CVE-2025-25204

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: gh versions 2.49.0 through 2.66.x

Description: A bug in GitHub's Artifact Attestation CLI tool, gh attestation verify, causes it to return a zero exit status when no attestations are present, under certain conditions. This behavior is incorrect, as it should return a non-zero exit status code to signal verification failure. An attacker can abuse this flaw to deploy malicious artifacts in any system that uses gh attestation verify's exit codes to gatekeep deployments.

Recommendations: For gh versions 2.49.0 through 2.66.x, update to version v2.67.0 as soon as possible. As a temporary workaround, consider verifying the output of gh attestation verify beyond just the exit code to ensure that the attestation was successfully verified.

Exploit

Fix

Weakness Enumeration

CWE-390

Related Identifiers

AZL-56885

CVE-2025-25204

GHSA-FGW4-V983-MGP8

GO-2025-3467

OPENSUSE-SU-2025:14889-1

Affected Products

Gh

References · 48

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25204.json · Exploit
• https://osv.dev/vulnerability/GHSA-fgw4-v983-mgp8 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3467 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-25204 · Security Note
• https://osv.dev/vulnerability/AZL-56885 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-25204 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14889-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-25204 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-25204 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-25204 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25204 · Security Note
• https://github.com/cli/cli · Note
• https://github.com/cli/cli/pull/10421 · Note
• https://github.com/cli/cli/security/advisories/GHSA-fgw4-v983-mgp8 · Note
• https://github.com/cli/cli/issues/10418 · Note