Threats tagged 'ghsa-88h9-77c7-p6w4'

A vulnerability in the evervault-go SDK's enclave attestation verification logic allows incomplete attestation documents to pass validation, potentially causing clients to trust enclaves that do not meet integrity guarantees. The issue mainly affects applications that only check PCR8, with reduced impact if PCR0, PCR1, and PCR2 are also checked. The flaw is fixed in version 1.3.2 by improving attestation document validation and PCR comparison logic. Workarounds exist for users who cannot upgrade, involving stricter PCR presence checks.