CVE-2025-68121 detected on CustomScriptExtension 2.1.19 on AzureLinux V3

CRI 21000001809436

security scanning tool (Orca) identified CVE-2025-68121 on AKS nodes. The vulnerability was detected in the following binaries:

/var/lib/waagent/Microsoft.Azure.Extensions.CustomScript-2.1.19/bin/custom-script-extension
/var/lib/waagent/Microsoft.Azure.Extensions.CustomScript-2.1.19/bin/custom-script-extension-arm64

[CVE Record: CVE-2025-68121](https://www.cve.org/CVERecord?id=CVE-2025-68121)

CSE 2.1.19 seems to be there [CSE 2.1.19 by norakoiralamsft · Pull Request #256 · Azure/custom-script-extension-linux](https://github.com/Azure/custom-script-extension-linux/pull/256)

And it seems to have golang.org/x/crypto version v0.45.0
[golang.org/x/crypto version update by norakoiralamsft · Pull Request #245 · Azure/custom-script-extension-linux](https://github.com/Azure/custom-script-extension-linux/pull/245/changes)

So I'm not sure of the [CVE Record: CVE-2025-68121](https://www.cve.org/CVERecord?id=CVE-2025-68121) which says :

Vendor = Go standard library

Product = crypto/tls

Versions 3 Total

Default Status: unaffected

affected

affectedfrom 0before 1.24.13

affectedfrom 1.25.0-0before 1.25.7

affectedfrom 1.26.0-rc.1before 1.26.0-rc.3

Inizia con i due binari CustomScriptExtension 2.1.19 elencati nell’issue e confronta le informazioni sulle loro dipendenze Go con il record CVE. Leggi le PR #256 e #245 insieme ai dettagli del CVE per determinare se la vulnerabilità segnalata in crypto/tls è applicabile. Il lavoro è terminato quando l’impatto è confermato o escluso e l’issue riporta la remediation o la giustificazione necessaria.

Scritto dal modello di indicizzazione a partire dal testo della issue.