{"answers":{"affected":"4 open source packages ship an affected version, including github.com/edgelesssys/constellation/v2 and github.com/edgelesssys/constellation.","exploited":"There is no known exploitation of CVE-2025-58356 in the wild and no public exploit code.","fix":"Upgrade github.com/edgelesssys/constellation/v2 to 2.24.0 or later.","what":"CVE-2025-58356 is a high-severity vulnerability in edgelesssys constellation, published on 27 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-58356 and fix it if it is affected.\n\nWhat it is: CVE-2025-58356 is a high-severity vulnerability in edgelesssys constellation, published on 27 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-58356 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/edgelesssys/constellation/v2 (Go): affected all versions; fixed in 2.24.0\n- github.com/edgelesssys/constellation/v2 (Go): affected all versions; fixed in 2.24.0\n- github.com/edgelesssys/constellation/v2 (Go): affected all versions; fixed in 2.24.0\n- github.com/edgelesssys/constellation (Go): affected all versions; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-58356/ (Markdown: https://insights.sbomify.com/CVE-2025-58356/index.md)","id":"CVE-2025-58356","markdown":"https://insights.sbomify.com/CVE-2025-58356/index.md","name":"CVE-2025-58356","record":{"aliases":["GHSA-hq76-6gh2-5g4q","GO-2025-4076"],"analysis":{"component_type":"container_or_infrastructure","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Confidential Kubernetes","requires_auth":"high_privilege","summary":"Attackers can bypass LUKS2 encryption in Constellation CVMs due to unsafe null keyslot handling, exposing persistent storage data.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":8.3,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-347","name":"Improper Verification of Cryptographic Signature"}],"description":"Constellation is the first Confidential Kubernetes. The Constellation CVM image uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted storage device, the CVM uses the libcryptsetup function crypt_activate_by_passhrase. If the VM is successful in opening the partition with the disk encryption key, it treats the volume as confidential. However, due to the unsafe handling of null keyslot algorithms in the cryptsetup 2.8.1, it is possible that the opened volume is not encrypted at all. Cryptsetup prior to version 2.8.1 does not report an error when processing LUKS2-formatted disks that use the cipher_null-ecb algorithm in the keyslot encryption field. This vulnerability is fixed in 2.24.0.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Constellation allows insecure use of LUKS2 persistent storage partitions","id":"CVE-2025-58356","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"security_feature_bypass","year":"2025"},"n_packages":4,"n_references":3,"next":{"headline":"5ire Chat Message XSS Vulnerability Enables Remote Code Execution","id":"CVE-2025-58357"},"packages":[{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/edgelesssys/constellation","purl":"pkg:golang/github.com/edgelesssys/constellation","source":"GO-2025-4076"},{"ecosystem":"Go","fixed":["2.24.0"],"introduced":["0"],"last_affected":[],"package":"github.com/edgelesssys/constellation/v2","purl":null,"source":"GHSA-hq76-6gh2-5g4q"},{"ecosystem":"Go","fixed":["2.24.0"],"introduced":["0"],"last_affected":[],"package":"github.com/edgelesssys/constellation/v2","purl":"pkg:golang/github.com/edgelesssys/constellation/v2","source":"GHSA-hq76-6gh2-5g4q"},{"ecosystem":"Go","fixed":["2.24.0"],"introduced":["0"],"last_affected":[],"package":"github.com/edgelesssys/constellation/v2","purl":"pkg:golang/github.com/edgelesssys/constellation/v2","source":"GO-2025-4076"}],"prev":{"headline":"Soft Serve is vulnerable to arbitrary file writing through its SSH API","id":"CVE-2025-58355"},"products":["constellation"],"published":"2025-10-27","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-11-28","vendors":["edgelesssys"]},"summary":"Attackers can bypass LUKS2 encryption in Constellation CVMs due to unsafe null keyslot handling, exposing persistent storage data.","url":"https://insights.sbomify.com/CVE-2025-58356/"}