GHSA-r2h5-3hgw-8j34
User data in TPM attestation vulnerable to MITM
GHSA-r2h5-3hgw-8j34 is a vulnerability with no CVSS score yet in github.com/edgelesssys/constellation, published February 17, 2023. No source lists public exploit code. Fixed in github.com/edgelesssys/constellation/v2 2.5.2.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.5.2github.com/edgelesssys/constellation/v2 +2 more
Description
Impact
Attestation user data (such as the digest of the public key in an aTLS connection) was bound to the issuer's TPM, but not to its PCR state. An attacker could intercept a node initialization, initialize the node themselves, and then impersonate an uninitialized node to the validator. In practice, this meant that a CSP insider with sufficient privileges would have been able to join a node under their control to a Constellation cluster.
Patches
The issue has been patched in v2.5.2.
Workarounds
none
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/edgelesssys/constellation/v2Go | through 2.5.1 | 2.5.2 |
github.com/edgelesssys/constellation/v2Go | before 2.5.2 | 2.5.2 |
github.com/edgelesssys/constellationGo | All versions | None known |
What each source reports
GitHub AdvisoriesNo score
User data in TPM attestation vulnerable to MITM
Impact
Attestation user data (such as the digest of the public key in an aTLS connection) was bound to the issuer's TPM, but not to its PCR state. An attacker could intercept a node initialization, initialize the node themselves, and then impersonate an uninitialized node to the validator. In practice, this meant that a CSP insider with sufficient privileges would have been able to join a node under their control to a Constellation cluster.
Patches
The issue has been patched in v2.5.2.
Workarounds
none
- Record
GHSA-r2h5-3hgw-8j34- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVNo score
User data in TPM attestation vulnerable to MITM
Impact
Attestation user data (such as the digest of the public key in an aTLS connection) was bound to the issuer's TPM, but not to its PCR state. An attacker could intercept a node initialization, initialize the node themselves, and then impersonate an uninitialized node to the validator. In practice, this meant that a CSP insider with sufficient privileges would have been able to join a node under their control to a Constellation cluster.
Patches
The issue has been patched in v2.5.2.
Workarounds
none
- Record
GHSA-r2h5-3hgw-8j34- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGO-2023-1583No score
User data in TPM attestation vulnerable to MITM in github.com/edgelesssys/constellation
User data in TPM attestation vulnerable to MITM in github.com/edgelesssys/constellation
- Record
GO-2023-1583- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.