User data in TPM attestation vulnerable to MITM in github.com/edgelesssys/constellation
Summary
GO-2023-1583: User data in TPM attestation vulnerable to MITM in github.com/edgelesssys/constellation. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/edgelesssys/constellation is a Go package that provides functionality for TPM (Trusted Platform Module) attestation. TPM attestation is a process that verifies the integrity and authenticity of a system's hardware and software configuration. The package allows users to generate and verify attestation data using TPM. However, a vulnerability has been discovered in the package that exposes user data to a Man-in-the-Middle (MITM) attack.
Vulnerability Detail
The vulnerability in github.com/edgelesssys/constellation allows an attacker to intercept and modify user data during the TPM attestation process. This can lead to unauthorized access, data tampering, and potential compromise of the entire system's security. The vulnerability arises due to a lack of proper encryption and authentication mechanisms in the attestation process, making it susceptible to MITM attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually verify the integrity of the attestation data by comparing it with a trusted source. This can be done by cross-referencing the attestation data with a known good configuration or by using a separate trusted attestation service.
Conclusion
The vulnerability in github.com/edgelesssys/constellation exposes user data in TPM attestation to potential interception and modification by an attacker. It is crucial for the developers to implement strong encryption and authentication mechanisms to prevent Man-in-the-Middle attacks. Users should update to version 2.5.2 or later to fix the vulnerability.
See every vulnerability recorded for github.com/edgelesssys/constellation →
FAQ
TPM attestation is a process that verifies the integrity and authenticity of a system's hardware and software configuration using a Trusted Platform Module (TPM) chip.
A Man-in-the-Middle (MITM) attack is a type of cyber attack where an attacker intercepts and modifies communication between two parties without their knowledge.
The vulnerability in github.com/edgelesssys/constellation exposes user data to potential interception and modification by an attacker during the TPM attestation process. This can lead to unauthorized access and data tampering.
Yes, all versions of github.com/edgelesssys/constellation up to and including version 2.5.1 are affected by this vulnerability.
Yes, a fix is available in version 2.5.2 of github.com/edgelesssys/constellation. Users are advised to update to this version or later to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/edgelesssys/constellation.
