CVE-2025-3879 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2025-3879 Interim 1 8 2026-03-05T01:32:36Z current 2025-05-08T23:18:19Z 2026-03-05T01:32:36Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2025-3879 Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HNV7O7SNYYY4AFS5HKAPLITKK3B57LE7/ E-Mail link for openSUSE-SU-2025:15059-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise Server 15 SP5-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server Teradata 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Manager Proxy 4.3 SUSE Manager Proxy LTS 4.3 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Manager Retail Branch Server 4.3 SUSE Manager Retail Branch Server LTS 4.3 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Manager Server 4.3 SUSE Manager Server LTS 4.3 openSUSE Leap 15.6 openSUSE Tumbleweed alloy cosign cosign-bash-completion cosign-zsh-completion govulncheck-vulndb-0.0.20250506T153719-1.1 govulncheck-vulndb-0.0.20250814T182633-160000.1.2 libexpat1-2.7.1-slfo.1.1_3.1 rekor terraform terraform-provider-aws libexpat1-2.7.1-slfo.1.1_3.1 as a component of Container suse/sl-micro/6.0/baremetal-os-container:latest libexpat1-2.7.1-slfo.1.1_3.1 as a component of Container suse/sl-micro/6.0/base-os-container:latest libexpat1-2.7.1-slfo.1.1_3.1 as a component of Container suse/sl-micro/6.0/kvm-os-container:latest libexpat1-2.7.1-slfo.1.1_3.1 as a component of Container suse/sl-micro/6.0/rt-os-container:latest libexpat1-2.7.1-slfo.1.1_3.1 as a component of Container suse/sl-micro/6.0/toolbox:latest libexpat1-2.7.1-slfo.1.1_3.1 as a component of Image SL-Micro libexpat1-2.7.1-slfo.1.1_3.1 as a component of Image SLE-Micro libexpat1-2.7.1-slfo.1.1_3.1 as a component of Image SLE-Micro-Azure libexpat1-2.7.1-slfo.1.1_3.1 as a component of Image SLE-Micro-BYOS libexpat1-2.7.1-slfo.1.1_3.1 as a component of Image SLE-Micro-BYOS-Azure libexpat1-2.7.1-slfo.1.1_3.1 as a component of Image SLE-Micro-BYOS-EC2 libexpat1-2.7.1-slfo.1.1_3.1 as a component of Image SLE-Micro-BYOS-GCE libexpat1-2.7.1-slfo.1.1_3.1 as a component of Image SLE-Micro-EC2 libexpat1-2.7.1-slfo.1.1_3.1 as a component of Image SLE-Micro-GCE govulncheck-vulndb-0.0.20250814T182633-160000.1.2 as a component of SUSE Linux Enterprise Server 16.0 govulncheck-vulndb-0.0.20250506T153719-1.1 as a component of openSUSE Tumbleweed cosign as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS rekor as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS cosign as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS rekor as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS cosign as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS rekor as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS cosign as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 rekor as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 cosign as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 cosign-bash-completion as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 cosign-zsh-completion as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 rekor as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 terraform as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP4 terraform-provider-aws as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP4 terraform as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP5 terraform-provider-aws as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP5 cosign as a component of SUSE Linux Enterprise Server 15 SP4-LTSS rekor as a component of SUSE Linux Enterprise Server 15 SP4-LTSS cosign as a component of SUSE Linux Enterprise Server 15 SP5-LTSS rekor as a component of SUSE Linux Enterprise Server 15 SP5-LTSS alloy as a component of SUSE Linux Enterprise Server 16.0 cosign as a component of SUSE Linux Enterprise Server 16.0 rekor as a component of SUSE Linux Enterprise Server 16.0 cosign as a component of SUSE Linux Enterprise Server Teradata 15 SP4 rekor as a component of SUSE Linux Enterprise Server Teradata 15 SP4 terraform as a component of SUSE Linux Enterprise Server Teradata 15 SP4 terraform-provider-aws as a component of SUSE Linux Enterprise Server Teradata 15 SP4 cosign as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 rekor as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 cosign as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 rekor as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 cosign as a component of SUSE Manager Proxy 4.3 rekor as a component of SUSE Manager Proxy 4.3 cosign as a component of SUSE Manager Proxy LTS 4.3 rekor as a component of SUSE Manager Proxy LTS 4.3 cosign as a component of SUSE Manager Retail Branch Server 4.3 rekor as a component of SUSE Manager Retail Branch Server 4.3 cosign as a component of SUSE Manager Retail Branch Server LTS 4.3 rekor as a component of SUSE Manager Retail Branch Server LTS 4.3 cosign as a component of SUSE Manager Server 4.3 rekor as a component of SUSE Manager Server 4.3 cosign as a component of SUSE Manager Server LTS 4.3 rekor as a component of SUSE Manager Server LTS 4.3 cosign as a component of openSUSE Leap 15.6 rekor as a component of openSUSE Leap 15.6 terraform as a component of openSUSE Leap 15.6 terraform-provider-aws as a component of openSUSE Leap 15.6 Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18. CVE-2025-3879 Container suse/sl-micro/6.0/baremetal-os-container:latest:libexpat1-2.7.1-slfo.1.1_3.1 Container suse/sl-micro/6.0/base-os-container:latest:libexpat1-2.7.1-slfo.1.1_3.1 Container suse/sl-micro/6.0/kvm-os-container:latest:libexpat1-2.7.1-slfo.1.1_3.1 Container suse/sl-micro/6.0/rt-os-container:latest:libexpat1-2.7.1-slfo.1.1_3.1 Container suse/sl-micro/6.0/toolbox:latest:libexpat1-2.7.1-slfo.1.1_3.1 Image SL-Micro:libexpat1-2.7.1-slfo.1.1_3.1 Image SLE-Micro:libexpat1-2.7.1-slfo.1.1_3.1 Image SLE-Micro-Azure:libexpat1-2.7.1-slfo.1.1_3.1 Image SLE-Micro-BYOS:libexpat1-2.7.1-slfo.1.1_3.1 Image SLE-Micro-BYOS-Azure:libexpat1-2.7.1-slfo.1.1_3.1 Image SLE-Micro-BYOS-EC2:libexpat1-2.7.1-slfo.1.1_3.1 Image SLE-Micro-BYOS-GCE:libexpat1-2.7.1-slfo.1.1_3.1 Image SLE-Micro-EC2:libexpat1-2.7.1-slfo.1.1_3.1 Image SLE-Micro-GCE:libexpat1-2.7.1-slfo.1.1_3.1 SUSE Linux Enterprise Server 16.0:govulncheck-vulndb-0.0.20250814T182633-160000.1.2 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250506T153719-1.1 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:cosign SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rekor SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:cosign SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rekor SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:cosign SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rekor SUSE Linux Enterprise Module for Basesystem 15 SP6:cosign SUSE Linux Enterprise Module for Basesystem 15 SP6:rekor SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-bash-completion SUSE Linux Enterprise Module for Basesystem 15 SP7:cosign-zsh-completion SUSE Linux Enterprise Module for Basesystem 15 SP7:rekor SUSE Linux Enterprise Module for Public Cloud 15 SP4:terraform SUSE Linux Enterprise Module for Public Cloud 15 SP4:terraform-provider-aws SUSE Linux Enterprise Module for Public Cloud 15 SP5:terraform SUSE Linux Enterprise Module for Public Cloud 15 SP5:terraform-provider-aws SUSE Linux Enterprise Server 15 SP4-LTSS:cosign SUSE Linux Enterprise Server 15 SP4-LTSS:rekor SUSE Linux Enterprise Server 15 SP5-LTSS:cosign SUSE Linux Enterprise Server 15 SP5-LTSS:rekor SUSE Linux Enterprise Server 16.0:alloy SUSE Linux Enterprise Server 16.0:cosign SUSE Linux Enterprise Server 16.0:rekor SUSE Linux Enterprise Server Teradata 15 SP4:cosign SUSE Linux Enterprise Server Teradata 15 SP4:rekor SUSE Linux Enterprise Server Teradata 15 SP4:terraform SUSE Linux Enterprise Server Teradata 15 SP4:terraform-provider-aws SUSE Linux Enterprise Server for SAP Applications 15 SP4:cosign SUSE Linux Enterprise Server for SAP Applications 15 SP4:rekor SUSE Linux Enterprise Server for SAP Applications 15 SP5:cosign SUSE Linux Enterprise Server for SAP Applications 15 SP5:rekor SUSE Manager Proxy 4.3:cosign SUSE Manager Proxy 4.3:rekor SUSE Manager Proxy LTS 4.3:cosign SUSE Manager Proxy LTS 4.3:rekor SUSE Manager Retail Branch Server 4.3:cosign SUSE Manager Retail Branch Server 4.3:rekor SUSE Manager Retail Branch Server LTS 4.3:cosign SUSE Manager Retail Branch Server LTS 4.3:rekor SUSE Manager Server 4.3:cosign SUSE Manager Server 4.3:rekor SUSE Manager Server LTS 4.3:cosign SUSE Manager Server LTS 4.3:rekor openSUSE Leap 15.6:cosign openSUSE Leap 15.6:rekor openSUSE Leap 15.6:terraform openSUSE Leap 15.6:terraform-provider-aws important 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H