Threats tagged 'ghsa-ghwv-vrp2-2975'

Cocos AI's intra-handshake attested TLS implementation is vulnerable to a Time-Of-Check to Time-Of-Use (TOCTOU) attack. An attacker who can modify the attested workload's code, memory state, or configuration after the initial attestation but without terminating the TLS connection can cause the peer to continue trusting a stale attestation state. This vulnerability affects long-lived TLS connections because attestation is only performed once at connection establishment, with no mechanism for re-attestation during the connection lifetime. The issue was discovered through formal analysis and affects versions prior to 0.9.0.