CVE-2025-54471: Github.com/neuvector/neuvector NeuVector Is Shipping Cryptographic Material Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-h773-7gf7-9m2x",
  "modified" : "2025-10-30T17:58:58Z",
  "published" : "2025-10-21T20:26:25Z",
  "aliases" : [ "CVE-2025-54471" ],
  "summary" : "NeuVector is shipping cryptographic material into its binary",
  "details" : "### Impact\nNeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations  when NeuVector stores the data.\n\nIn the patched version, NeuVector leverages the Kubernetes secret `neuvector-store-secret` in `neuvector` namespace to dynamically generate cryptographically secure random keys. This approach removes the reliance on static key values and ensures that encryption keys are managed securely within Kubernetes.\n\nDuring rolling upgrade or restoring from persistent storage, the NeuVector controller checks each encrypted configured field. If a sensitive field in the configuration is found to be encrypted by the default encryption key, it’s decrypted with the default encryption key and then re-encrypted with the new dynamic encryption key.\n\nIf the NeuVector controller does not have the correct RBAC for accessing the new secret, it writes this error log : \n`Required Kubernetes RBAC for secrets are not found` and exits.\n\nThe device encryption key is rotated every 3 months. For details, please refer to this [Rotating Self-Signed Certificate](https://open-docs.neuvector.com/configuration/console/certrotate) documentation.\n\n### Patches\nPatched versions include release **v5.4.7** and above.\n\n### Workarounds\nThere is no workaround for this issue. Users are recommended to upgrade, as soon as possible, to a version of NeuVector that contains the fix.\n\n### References\nIf you have any questions or comments about this advisory:\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/neuvector/neuvector"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.3.0"
      }, {
        "fixed" : "5.4.7"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.4.6"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/neuvector/neuvector"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.0.0-20230727023453-1c4957d53911"
      }, {
        "fixed" : "0.0.0-20251020133207-084a437033b4"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/neuvector/neuvector/security/advisories/GHSA-h773-7gf7-9m2x"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-54471"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/neuvector/neuvector/commit/084a437033b491eeea11bdba1a09dd84ed12ea88"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54471"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/neuvector/neuvector"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-321" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-10-21T20:26:25Z",
    "nvd_published_at" : "2025-10-30T10:15:35Z"
  }
}