CVE-2026-108362
Severity not reportedPrivasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections.
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, the verifier accepts valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. The attacker can impersonate the attested TLS endpoint. This issue is fixed in version 0.11.0.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/Privasys/ra-tls-clients/commit/1179ed097fdcb8519a85973a8a6c6ccbd0f50b03 security-advisories@github.com
- https://github.com/Privasys/ra-tls-clients/releases/tag/v0.11.0 security-advisories@github.com
- https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-pj2x-5wqv-fh57 security-advisories@github.com