CVE-2025-68121 detected on CustomScriptExtension 2.1.19 on AzureLinux V3
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- azure, go
- Domain
- cloud, infrastructure, security
Research direction
Start with the two CustomScriptExtension 2.1.19 binaries listed in the issue and compare their Go dependency information with the CVE record. Read PRs #256 and #245 alongside the CVE details to determine whether the reported crypto/tls vulnerability applies. Done means the impact is confirmed or ruled out and the issue records the required remediation or justification.
Written by the indexing model from the issue text.
Description
CRI 21000001809436
security scanning tool (Orca) identified CVE-2025-68121 on AKS nodes. The vulnerability was detected in the following binaries:
/var/lib/waagent/Microsoft.Azure.Extensions.CustomScript-2.1.19/bin/custom-script-extension
/var/lib/waagent/Microsoft.Azure.Extensions.CustomScript-2.1.19/bin/custom-script-extension-arm64
CSE 2.1.19 seems to be there CSE 2.1.19 by norakoiralamsft · Pull Request #256 · Azure/custom-script-extension-linux
And it seems to have golang.org/x/crypto version v0.45.0
golang.org/x/crypto version update by norakoiralamsft · Pull Request #245 · Azure/custom-script-extension-linux
So I'm not sure of the CVE Record: CVE-2025-68121 which says :
Vendor = Go standard library
Product = crypto/tls
Versions 3 Total
Default Status: unaffected
affected
affectedfrom 0before 1.24.13
affectedfrom 1.25.0-0before 1.25.7
affectedfrom 1.26.0-rc.1before 1.26.0-rc.3
- Dominant language
- Go
- Stars
- 113
- Forks
- 46
- Avg merge
- 4d 15h
- Merged PRs (30d)
- 3
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Azure/custom-script-extension-linux
-
Difficulty 1/5 Under an hour Newbie friendliness 45/100
-
Difficulty 5/5 Over a week Newbie friendliness 20/100
-
Difficulty 3/5 1-2 days Newbie friendliness 30/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
All issues in Azure/custom-script-extension-linux
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 84/100
-
enhancement needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
kind/cleanup
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
kubernetes-sigs/kueue#15947 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
sympozium-ai/sympozium#627 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100