Refine your search
7 vulnerabilities found for by Privasys
CVE-2026-108361 (GCVE-0-2026-108361)
Vulnerability from cvelistv5
Published
2026-10-12 19:06
Modified
2026-10-15 13:41
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Summary
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully appraised and the connection was established, there was a window of vulnerability from the establishment of the connection to the termination of the connection where an attacker could modify the state of the workload and platform at runtime on the TLS endpoint acting as the Attester. This vulnerability was possible because Privasys/ra-tls-clients performed attestation only once in the lifetime of the connection (at connection establishment time), and the verifying peer continued to believe that the state was the same as in the initial Evidence throughout, whereas it could be stale at some point in time. This vulnerability is fixed in 0.9.1.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Privasys | ra-tls-clients |
Version: < 0.9.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108361",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T13:41:22.542322Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T13:41:30.986Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ra-tls-clients",
"vendor": "Privasys",
"versions": [
{
"status": "affected",
"version": "\u003c 0.9.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully appraised and the connection was established, there was a window of vulnerability from the establishment of the connection to the termination of the connection where an attacker could modify the state of the workload and platform at runtime on the TLS endpoint acting as the Attester. This vulnerability was possible because Privasys/ra-tls-clients performed attestation only once in the lifetime of the connection (at connection establishment time), and the verifying peer continued to believe that the state was the same as in the initial Evidence throughout, whereas it could be stale at some point in time. This vulnerability is fixed in 0.9.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T19:06:20.005Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-gg8q-mfhh-wrrc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-gg8q-mfhh-wrrc"
},
{
"name": "https://github.com/Privasys/ra-tls-clients/commit/076074873117ee5ff35a7c39e02952c28de3df0c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Privasys/ra-tls-clients/commit/076074873117ee5ff35a7c39e02952c28de3df0c"
},
{
"name": "https://github.com/Privasys/ra-tls-clients/commit/5ccfd778132e17cb54bb1a9c7b89d57fcfea59ec",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Privasys/ra-tls-clients/commit/5ccfd778132e17cb54bb1a9c7b89d57fcfea59ec"
},
{
"name": "https://github.com/Privasys/ra-tls-clients/commit/b9114d772a636ad3307957dde4bb8afe70c9b40d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Privasys/ra-tls-clients/commit/b9114d772a636ad3307957dde4bb8afe70c9b40d"
}
],
"source": {
"advisory": "GHSA-gg8q-mfhh-wrrc",
"discovery": "UNKNOWN"
},
"title": "Privasys Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-108361",
"datePublished": "2026-10-12T19:06:20.005Z",
"dateReserved": "2026-10-09T20:32:44.301Z",
"dateUpdated": "2026-10-15T13:41:30.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108362 (GCVE-0-2026-108362)
Vulnerability from cvelistv5
Published
2026-10-12 19:06
Modified
2026-10-13 15:00
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-346 - Origin Validation Error
Summary
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, the verifier accepts valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. The attacker can impersonate the attested TLS endpoint. This issue is fixed in version 0.11.0.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Privasys | ra-tls-clients |
Version: < 0.11.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108362",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:00:07.980029Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:00:30.012Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ra-tls-clients",
"vendor": "Privasys",
"versions": [
{
"status": "affected",
"version": "\u003c 0.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, the verifier accepts valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. The attacker can impersonate the attested TLS endpoint. This issue is fixed in version 0.11.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T19:06:11.348Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-pj2x-5wqv-fh57",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-pj2x-5wqv-fh57"
},
{
"name": "https://github.com/Privasys/ra-tls-clients/commit/1179ed097fdcb8519a85973a8a6c6ccbd0f50b03",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Privasys/ra-tls-clients/commit/1179ed097fdcb8519a85973a8a6c6ccbd0f50b03"
},
{
"name": "https://github.com/Privasys/ra-tls-clients/releases/tag/v0.11.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Privasys/ra-tls-clients/releases/tag/v0.11.0"
}
],
"source": {
"advisory": "GHSA-pj2x-5wqv-fh57",
"discovery": "UNKNOWN"
},
"title": "Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-108362",
"datePublished": "2026-10-12T19:06:11.348Z",
"dateReserved": "2026-10-09T20:32:44.301Z",
"dateUpdated": "2026-10-13T15:00:30.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108269 (GCVE-0-2026-108269)
Vulnerability from cvelistv5
Published
2026-10-09 21:15
Modified
2026-10-13 20:25
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-346 - Origin Validation Error
Summary
Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not to the active TLS session before permitting application traffic. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing the clients to accept an attacker-terminated connection as the attested enclave. This issue is fixed in 0.5.0.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Privasys | ra-tls-clients |
Version: < 0.5.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108269",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T20:13:27.706895Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T20:25:15.024Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ra-tls-clients",
"vendor": "Privasys",
"versions": [
{
"status": "affected",
"version": "\u003c 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not to the active TLS session before permitting application traffic. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing the clients to accept an attacker-terminated connection as the attested enclave. This issue is fixed in 0.5.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T21:15:12.264Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-5qrc-v874-mxvx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-5qrc-v874-mxvx"
},
{
"name": "https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-5qrc-v874-mxvx",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-5qrc-v874-mxvx"
},
{
"name": "https://github.com/Privasys/ra-tls-clients/commit/b8de9bcadd0f81ca8882d15095fc0d9c50e40148",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Privasys/ra-tls-clients/commit/b8de9bcadd0f81ca8882d15095fc0d9c50e40148"
},
{
"name": "https://github.com/Privasys/ra-tls-clients/releases/tag/v0.5.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Privasys/ra-tls-clients/releases/tag/v0.5.0"
},
{
"name": "https://privasys.org/blog/binding-attestation-to-the-tls-session",
"tags": [
"x_refsource_MISC"
],
"url": "https://privasys.org/blog/binding-attestation-to-the-tls-session"
}
],
"source": {
"advisory": "GHSA-5qrc-v874-mxvx",
"discovery": "UNKNOWN"
},
"title": "ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-108269",
"datePublished": "2026-10-09T21:15:12.264Z",
"dateReserved": "2026-10-09T17:33:15.410Z",
"dateUpdated": "2026-10-13T20:25:15.024Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108268 (GCVE-0-2026-108268)
Vulnerability from cvelistv5
Published
2026-10-09 21:13
Modified
2026-10-13 11:31
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-346 - Origin Validation Error
Summary
Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in tdx-v0.2.43 and tdx-gpu-v0.6.27.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Privasys | enclave-os-virtual |
Version: < tdx-v0.2.43 Version: < tdx-gpu-v0.6.27 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108268",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T11:29:30.644389Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T11:31:04.583Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "enclave-os-virtual",
"vendor": "Privasys",
"versions": [
{
"status": "affected",
"version": "\u003c tdx-v0.2.43"
},
{
"status": "affected",
"version": "\u003c tdx-gpu-v0.6.27"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in tdx-v0.2.43 and tdx-gpu-v0.6.27."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T21:13:33.595Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Privasys/enclave-os-virtual/security/advisories/GHSA-p5fp-g94g-g9m9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Privasys/enclave-os-virtual/security/advisories/GHSA-p5fp-g94g-g9m9"
},
{
"name": "https://github.com/Privasys/enclave-os-virtual/commit/9a6be91e29f2b6738d0b77c33cd1ad5cd3d8a347",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Privasys/enclave-os-virtual/commit/9a6be91e29f2b6738d0b77c33cd1ad5cd3d8a347"
},
{
"name": "https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-gpu-v0.6.27",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-gpu-v0.6.27"
},
{
"name": "https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-v0.2.43",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-v0.2.43"
},
{
"name": "https://privasys.org/blog/binding-attestation-to-the-tls-session",
"tags": [
"x_refsource_MISC"
],
"url": "https://privasys.org/blog/binding-attestation-to-the-tls-session"
}
],
"source": {
"advisory": "GHSA-p5fp-g94g-g9m9",
"discovery": "UNKNOWN"
},
"title": "enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-108268",
"datePublished": "2026-10-09T21:13:33.595Z",
"dateReserved": "2026-10-09T17:33:15.410Z",
"dateUpdated": "2026-10-13T11:31:04.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108267 (GCVE-0-2026-108267)
Vulnerability from cvelistv5
Published
2026-10-09 21:11
Modified
2026-10-13 15:53
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-346 - Origin Validation Error
Summary
Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept a handshake terminated by the attacker as an attested enclave connection. This issue is fixed in privasys-v0.5.1-go1.26.5.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108267",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:52:56.413100Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:53:06.405Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "go",
"vendor": "Privasys",
"versions": [
{
"status": "affected",
"version": "\u003c privasys-v0.5.1-go1.26.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept a handshake terminated by the attacker as an attested enclave connection. This issue is fixed in privasys-v0.5.1-go1.26.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T21:11:33.186Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Privasys/go/security/advisories/GHSA-7jfw-53rm-phh2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Privasys/go/security/advisories/GHSA-7jfw-53rm-phh2"
},
{
"name": "https://github.com/Privasys/go/commit/00a7d21ba53bba0ea09ac7a67eb2c6714e651700",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Privasys/go/commit/00a7d21ba53bba0ea09ac7a67eb2c6714e651700"
},
{
"name": "https://github.com/Privasys/go/releases/tag/privasys-v0.5.1-go1.26.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Privasys/go/releases/tag/privasys-v0.5.1-go1.26.5"
},
{
"name": "https://privasys.org/blog/binding-attestation-to-the-tls-session",
"tags": [
"x_refsource_MISC"
],
"url": "https://privasys.org/blog/binding-attestation-to-the-tls-session"
}
],
"source": {
"advisory": "GHSA-7jfw-53rm-phh2",
"discovery": "UNKNOWN"
},
"title": "Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-108267",
"datePublished": "2026-10-09T21:11:33.186Z",
"dateReserved": "2026-10-09T17:33:15.410Z",
"dateUpdated": "2026-10-13T15:53:06.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108266 (GCVE-0-2026-108266)
Vulnerability from cvelistv5
Published
2026-10-09 21:00
Modified
2026-10-14 02:16
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-346 - Origin Validation Error
Summary
Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in privasys-v0.8.1.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108266",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T02:16:05.581888Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T02:16:16.794Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rustls",
"vendor": "Privasys",
"versions": [
{
"status": "affected",
"version": "\u003c privasys-v0.8.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in privasys-v0.8.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T21:00:19.595Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Privasys/rustls/security/advisories/GHSA-j6qv-435v-r492",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Privasys/rustls/security/advisories/GHSA-j6qv-435v-r492"
},
{
"name": "https://github.com/Privasys/rustls/commit/ab630583b58fee84260cbbfe2f4a8b45d8bde200",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Privasys/rustls/commit/ab630583b58fee84260cbbfe2f4a8b45d8bde200"
},
{
"name": "https://github.com/Privasys/rustls/releases/tag/privasys-v0.8.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Privasys/rustls/releases/tag/privasys-v0.8.1"
},
{
"name": "https://privasys.org/blog/binding-attestation-to-the-tls-session",
"tags": [
"x_refsource_MISC"
],
"url": "https://privasys.org/blog/binding-attestation-to-the-tls-session"
}
],
"source": {
"advisory": "GHSA-j6qv-435v-r492",
"discovery": "UNKNOWN"
},
"title": "Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-108266",
"datePublished": "2026-10-09T21:00:19.595Z",
"dateReserved": "2026-10-09T17:33:15.410Z",
"dateUpdated": "2026-10-14T02:16:16.794Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108265 (GCVE-0-2026-108265)
Vulnerability from cvelistv5
Published
2026-10-09 20:55
Modified
2026-10-13 11:28
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-346 - Origin Validation Error
Summary
Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge certificate path placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in wasm-v0.40.0.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Privasys | enclave-os-mini |
Version: < wasm-v0.40.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108265",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T11:27:56.277437Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T11:28:12.950Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "enclave-os-mini",
"vendor": "Privasys",
"versions": [
{
"status": "affected",
"version": "\u003c wasm-v0.40.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime\u0027s RA-TLS challenge certificate path placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in wasm-v0.40.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T20:55:54.705Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Privasys/enclave-os-mini/security/advisories/GHSA-49qm-4pj3-w2c6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Privasys/enclave-os-mini/security/advisories/GHSA-49qm-4pj3-w2c6"
},
{
"name": "https://github.com/Privasys/enclave-os-mini/commit/9f541c849ef733d2df2851a666f359d01dcdcb8e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Privasys/enclave-os-mini/commit/9f541c849ef733d2df2851a666f359d01dcdcb8e"
},
{
"name": "https://github.com/Privasys/enclave-os-mini/releases/tag/wasm-v0.40.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Privasys/enclave-os-mini/releases/tag/wasm-v0.40.0"
},
{
"name": "https://privasys.org/blog/binding-attestation-to-the-tls-session",
"tags": [
"x_refsource_MISC"
],
"url": "https://privasys.org/blog/binding-attestation-to-the-tls-session"
}
],
"source": {
"advisory": "GHSA-49qm-4pj3-w2c6",
"discovery": "UNKNOWN"
},
"title": "enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-108265",
"datePublished": "2026-10-09T20:55:54.705Z",
"dateReserved": "2026-10-09T17:33:15.410Z",
"dateUpdated": "2026-10-13T11:28:12.950Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}