Security: CVE-2025-68121 - Critical TLS session resumption bypass in go/stdlib crypto/tls

## Security Vulnerability: CVE-2025-68121

**Severity:** Critical (CVSS v3.1: 10.0)
**Component:** `crypto/tls` — Go standard library
**GitHub Advisory:** GHSA-J443-WCQQ-XPRH
**Upstream Go Issue:** golang/go#77113

---

### Description

A critical vulnerability in Go's `crypto/tls` package allows TLS session resumption to bypass certificate authority trust validation. When `Config.ClientCAs` (server-side) or `Config.RootCAs` (client-side) are mutated between the initial handshake and a resumed handshake, the resumed session may succeed when it should be rejected.

**Impact:** Effective bypass of mutual TLS (mTLS) authentication. A client can resume a TLS session with a server it would not have trusted on a fresh handshake, or vice versa.

**Root cause:** `Config.Clone()` copies session ticket keys, and session resumption does not re-validate the full certificate chain against the current CA configuration.

---

### CVSS Details

| Field | Value |
|-------|-------|
| Score | **10.0 Critical** |
| Vector | `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` |
| CWE | CWE-295 (Improper Certificate Validation) |

---

### Affected Go Versions

| Branch | Vulnerable Range | Fixed In |
|--------|-----------------|----------|
| Go 1.24.x | All < 1.24.13 | **1.24.13** |
| Go 1.25.x | 1.25.0 – 1.25.6 | **1.25.7** |
| Go 1.26 | All < rc.3 | **1.26.0-rc.3** |

Any binary compiled with a vulnerable Go version is affected regardless of application-level code.

---

### Impact on vault-lambda-extension

`vault-lambda-extension` is a Go binary. If compiled with a vulnerable Go toolchain (< 1.24.13 or 1.25.0–1.25.6), it inherits this vulnerability. Given that vault-lambda-extension handles Vault token retrieval and TLS communication in Lambda environments, a mTLS bypass could allow:

- Unauthorized Vault token retrieval
- Connection to a rogue Vault server via session resumption
- Secrets exfiltration in compromised Lambda execution environments

---

### Remediation

Rebuild `vault-lambda-extension` with a patched Go toolchain:

```
go 1.24.13 # or 1.25.7+
```

Update `go.toolchain` directive in `go.mod` if pinned, and ensure CI/CD pipelines use the patched Go version.

---

### References

- [NVD: CVE-2025-68121](https://nvd.nist.gov/vuln/detail/cve-2025-68121)
- [GitHub Advisory GHSA-J443-WCQQ-XPRH](https://github.com/advisories/GHSA-J443-WCQQ-XPRH)
- [golang/go#77113](https://github.com/golang/go/issues/77113)
- [Go 1.24.13 Release Notes](https://go.dev/doc/devel/release#go1.24.13)
- [Wiz CVE Analysis](https://www.wiz.io/vulnerability-database/cve/cve-2025-68121)

---

### Suggested Fix

1. Update Go toolchain to `1.24.13` or `1.25.7`
2. Rebuild and release a patched binary
3. Update the Lambda layer with the patched extension