Vulnerabilidades do Confidential-containers Trustee
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Confidential-containers Trustee: 1 registro(s), com versões afetadas e correções.
CVE-2025-61779
Alta · 8.7
CWE-639 09/10/2025
Trustee's attestation-policy endpoint is not protected by admin autentication
Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0.15.0, the attestation-policy endpoint didn't check if the kbs-client submitting the request was actually authenticated (had the right key). This allowed any kbs-client to actually change the attestation policy. Version 0.15.0 fixes the issue.