Threats affecting pkg:cargo/tdx_workload_attestation

The tdx_workload_attestation Rust crate contained a vulnerability in the verify_x509_cert() function where the certificate validity period was not checked. This allowed acceptance of expired or not-yet-valid certificates during workload attestation, including GCP launch endorsement verification. Intel classified this as an escalation of privilege issue with a CVSS 4.0 base score of 5.9. The flaw was fixed in version 0.2.0 by adding validity period checks that cause the function to reject certificates outside their valid time range.

A vulnerability in the tdx_workload_attestation Rust crate allows a panic (denial of service) when processing a GCP launch endorsement that lacks TDX measurements. The issue occurs because the code reads a TDX measurement without verifying its presence, causing an index out of bounds panic. This flaw is fixed in version 0.2.0 by returning an error instead of panicking.