Skip to content
Fencer Intel
high —

GHSA-r2h5-3hgw-8j34 json

User data in TPM attestation vulnerable to MITM

published 3y ago modified 8mo ago also GO-2023-1583

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact Attestation *user data* (such as the digest of the public key in an aTLS connection) was bound to the issuer's TPM, but not to its PCR state. An attacker could intercept a node initialization, initialize the node themselves, and then impersonate an uninitialized node to the validator. In practice, this meant that a CSP insider with sufficient privileges would have been able to join a node under their control to a Constellation cluster.

### Patches The issue has been patched in [v2.5.2](https://github.com/edgelesssys/constellation/releases/tag/v2.5.2).

### Workarounds none

Patch / fix

  • go github.com/edgelesssys/constellation/v2 2.5.2

Is GHSA-r2h5-3hgw-8j34 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
go github.com/edgelesssys/constellation/v2
<2.5.2
2.5.2
go github.com/edgelesssys/constellation
all versions
 no fix listed

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.