-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing PCR state binding in TPM-based attestation. The aTLS implementation's user data binding and validation() functions would be directly responsible for including/verifying PCR measurements. The MITM attack vector suggests both generation (node initialization) and verification (validator) components were affected. While exact function names aren't provided, TPM attestation workflows typically involve distinct functions for creating attestation documents and validating() them, which aligns with the described attack scenario.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/edgelesssys/constellation/v2 | go | <= 2.5.1 | 2.5.2 |