Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1yMmg1LTNoZ3ctOGozNM4AAxt2

User data in TPM attestation vulnerable to MITM

Impact

Attestation user data (such as the digest of the public key in an aTLS connection) was bound to the issuer's TPM, but not to its PCR state. An attacker could intercept a node initialization, initialize the node themselves, and then impersonate an uninitialized node to the validator. In practice, this meant that a CSP insider with sufficient privileges would have been able to join a node under their control to a Constellation cluster.

Patches

The issue has been patched in v2.5.2.

Workarounds

none

Permalink: https://github.com/advisories/GHSA-r2h5-3hgw-8j34
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yMmg1LTNoZ3ctOGozNM4AAxt2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: about 1 year ago

Identifiers: GHSA-r2h5-3hgw-8j34
References:

• https://github.com/edgelesssys/constellation/security/advisories/GHSA-r2h5-3hgw-8j34
• https://github.com/edgelesssys/constellation/releases/tag/v2.5.2
• https://github.com/advisories/GHSA-r2h5-3hgw-8j34

Repository: https://github.com/edgelesssys/constellation
Blast Radius: 0.0

Affected Packages