{"id":"CVE-2025-62375","sourceIdentifier":"security-advisories@github.com","published":"2025-10-15T20:15:36.670","lastModified":"2026-10-08T11:10:00.250","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is not present or is empty, and when RSA signature verification fails. The attestor also embeds a single legacy global AWS public certificate and does not account for newer region specific certificates issued in 2024, making detection of forged documents difficult without additional trusted region data. An attacker able to supply or intercept instance identity document data (such as through Instance Metadata Service impersonation) can cause a forged identity document to be accepted, leading to incorrect trust decisions based on the attestation. This is fixed in go-witness 0.9.1 and witness 0.10.1. As a workaround, manually verify the included identity document, signature, and public key with standard tools (for example openssl) following AWS’s verification guidance, or disable use of the AWS attestor until upgraded."},{"lang":"es","value":"go-witness y witness son módulos Go para generar atestaciones. En las versiones 0.8.6 y anteriores de go-witness y las versiones 0.9.2 y anteriores de witness, el atestador de AWS verifica incorrectamente los documentos de identidad de instancia de AWS EC2. La verificación puede tener éxito incorrectamente cuando una firma no está presente o está vacía, y cuando falla la verificación de la firma RSA. El atestador también incrusta un único certificado público global heredado de AWS y no tiene en cuenta los certificados más recientes específicos de región emitidos en 2024, lo que dificulta la detección de documentos falsificados sin datos de región confiables adicionales. Un atacante capaz de suministrar o interceptar datos de documentos de identidad de instancia (como a través de la suplantación del Servicio de Metadatos de Instancia) puede hacer que se acepte un documento de identidad falsificado, lo que lleva a decisiones de confianza incorrectas basadas en la atestación. Esto se ha corregido en go-witness 0.9.1 y witness 0.10.1. Como solución alternativa, verifique manualmente el documento de identidad, la firma y la clave pública incluidos con herramientas estándar (por ejemplo, OpenSSL) siguiendo la guía de verificación de AWS, o deshabilite el uso del atestador de AWS hasta que se actualice."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"in-toto","product":"go-witness","versions":[{"version":"< 0.9.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-10-15T19:44:18.639906Z","id":"CVE-2025-62375","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://github.com/in-toto/go-witness/commit/04ff20b600e28ce8fd1aa287534dd383a1cfefb9","source":"security-advisories@github.com"},{"url":"https://github.com/in-toto/go-witness/security/advisories/GHSA-72c7-4g63-hpw5","source":"security-advisories@github.com"}]}