CVE-2026-108362

Published: Ott 12, 2026 Last Modified: Ott 12, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,1
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, the verifier accepts valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. The attacker can impersonate the attested TLS endpoint. This issue is fixed in version 0.11.0.

346

Origin Validation Error

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Other
Potential Impacts:
Gain Privileges Or Assume Identity Varies By Context
Applicable Platforms
Technologies: Not Technology-Specific, Web Based
View CWE Details
https://github.com/Privasys/ra-tls-clients/commit/1179ed097…
https://github.com/Privasys/ra-tls-clients/commit/1179ed097fdcb8519a85973a8a6c6…
https://github.com/Privasys/ra-tls-clients/releases/tag/v0.…
https://github.com/Privasys/ra-tls-clients/releases/tag/v0.11.0
https://github.com/Privasys/ra-tls-clients/security/advisor…
https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-pj2x-5wqv-f…