Description (CNA)
Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0.15.0, the attestation-policy endpoint didn't check if the kbs-client submitting the request was actually authenticated (had the right key). This allowed any kbs-client to actually change the attestation policy. Version 0.15.0 fixes the issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| confidential-containers / trustee | affected < 0.15.0 |
CWE
CWE-639
References
- https://github.com/confidential-containers/trustee/security/advisories/GHSA-49mc-2q77-m99x
- https://github.com/confidential-containers/trustee/pull/957
- https://github.com/confidential-containers/trustee/commit/3a7d04a70918fa503a00974dcae653cf9f0640e0
ADP enrichment
No English description supplied.