{"id":"GHSA-r2h5-3hgw-8j34","aliases":["GO-2023-1583"],"status":"published","title":"User data in TPM attestation vulnerable to MITM","description":"### Impact\nAttestation *user data* (such as the digest of the public key in an aTLS connection) was bound to the issuer's TPM, but not to its PCR state. An attacker could intercept a node initialization, initialize the node themselves, and then impersonate an uninitialized node to the validator. In practice, this meant that a CSP insider with sufficient privileges would have been able to join a node under their control to a Constellation cluster.\n\n### Patches\nThe issue has been patched in [v2.5.2](https://github.com/edgelesssys/constellation/releases/tag/v2.5.2).\n\n### Workarounds\nnone","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2023-02-17T20:51:24Z","modified":"2026-03-03T04:53:25Z","fixes":[{"ecosystem":"Go","package":"github.com/edgelesssys/constellation/v2","fixed_in":["2.5.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/edgelesssys/constellation/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.5.1"},{"fixed":"2.5.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/edgelesssys/constellation/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.5.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/edgelesssys/constellation","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/edgelesssys/constellation/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.5.2"}]}]}],"references":[{"url":"https://github.com/edgelesssys/constellation/security/advisories/GHSA-r2h5-3hgw-8j34","tags":["web","advisory"]},{"url":"https://github.com/edgelesssys/constellation/releases/tag/v2.5.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r2h5-3hgw-8j34"},{"url":"https://github.com/edgelesssys/constellation","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-r2h5-3hgw-8j34","title":"User data in TPM attestation vulnerable to MITM","description":"### Impact\nAttestation *user data* (such as the digest of the public key in an aTLS connection) was bound to the issuer's TPM, but not to its PCR state. An attacker could intercept a node initialization, initialize the node themselves, and then impersonate an uninitialized node to the validator. In practice, this meant that a CSP insider with sufficient privileges would have been able to join a node under their control to a Constellation cluster.\n\n### Patches\nThe issue has been patched in [v2.5.2](https://github.com/edgelesssys/constellation/releases/tag/v2.5.2).\n\n### Workarounds\nnone","status":"published","published":"2023-02-17T20:51:24Z","modified":"2023-02-17T20:51:24Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:45.67005Z"}],"osv":[{"id":"GHSA-r2h5-3hgw-8j34","title":"User data in TPM attestation vulnerable to MITM","description":"### Impact\nAttestation *user data* (such as the digest of the public key in an aTLS connection) was bound to the issuer's TPM, but not to its PCR state. An attacker could intercept a node initialization, initialize the node themselves, and then impersonate an uninitialized node to the validator. In practice, this meant that a CSP insider with sufficient privileges would have been able to join a node under their control to a Constellation cluster.\n\n### Patches\nThe issue has been patched in [v2.5.2](https://github.com/edgelesssys/constellation/releases/tag/v2.5.2).\n\n### Workarounds\nnone","status":"published","published":"2023-02-17T20:51:24Z","modified":"2024-08-20T20:59:06.947612Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"GO-2023-1583","title":"User data in TPM attestation vulnerable to MITM in github.com/edgelesssys/constellation","description":"User data in TPM attestation vulnerable to MITM in github.com/edgelesssys/constellation","status":"published","published":"2024-08-20T20:26:01Z","modified":"2026-03-03T04:53:25.154533Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}