Vulnerability-Lookup

CVE-2025-62375 (GCVE-0-2025-62375)

Vulnerability from cvelistv5 – Published: 2025-10-15 19:23 – Updated: 2025-10-15 19:44

Title

go-witness Improper Verification of AWS EC2 Identity Documents

Summary

go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is not present or is empty, and when RSA signature verification fails. The attestor also embeds a single legacy global AWS public certificate and does not account for newer region specific certificates issued in 2024, making detection of forged documents difficult without additional trusted region data. An attacker able to supply or intercept instance identity document data (such as through Instance Metadata Service impersonation) can cause a forged identity document to be accepted, leading to incorrect trust decisions based on the attestation. This is fixed in go-witness 0.9.1 and witness 0.10.1. As a workaround, manually verify the included identity document, signature, and public key with standard tools (for example openssl) following AWS’s verification guidance, or disable use of the AWS attestor until upgraded.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-15 19:44 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7552 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/in-toto/go-witness/security/ad…	x_refsource_CONFIRM
https://github.com/in-toto/go-witness/commit/04ff…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
in-toto	go-witness	Affected: < 0.9.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-62375",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-15T19:44:18.639906Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-15T19:44:29.097Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go-witness",
          "vendor": "in-toto",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.9.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is not present or is empty, and when RSA signature verification fails. The attestor also embeds a single legacy global AWS public certificate and does not account for newer region specific certificates issued in 2024, making detection of forged documents difficult without additional trusted region data. An attacker able to supply or intercept instance identity document data (such as through Instance Metadata Service impersonation) can cause a forged identity document to be accepted, leading to incorrect trust decisions based on the attestation. This is fixed in go-witness 0.9.1 and witness 0.10.1. As a workaround, manually verify the included identity document, signature, and public key with standard tools (for example openssl) following AWS\u2019s verification guidance, or disable use of the AWS attestor until upgraded."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-15T19:23:24.916Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/in-toto/go-witness/security/advisories/GHSA-72c7-4g63-hpw5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/in-toto/go-witness/security/advisories/GHSA-72c7-4g63-hpw5"
        },
        {
          "name": "https://github.com/in-toto/go-witness/commit/04ff20b600e28ce8fd1aa287534dd383a1cfefb9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/in-toto/go-witness/commit/04ff20b600e28ce8fd1aa287534dd383a1cfefb9"
        }
      ],
      "source": {
        "advisory": "GHSA-72c7-4g63-hpw5",
        "discovery": "UNKNOWN"
      },
      "title": "go-witness Improper Verification of AWS EC2 Identity Documents"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-62375",
    "datePublished": "2025-10-15T19:23:24.916Z",
    "dateReserved": "2025-10-10T14:22:48.204Z",
    "dateUpdated": "2025-10-15T19:44:29.097Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-62375",
      "date": "2026-10-11",
      "epss": "0.00204",
      "percentile": "0.09537"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "go-witness",
                "vendor": "in-toto",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.9.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is not present or is empty, and when RSA signature verification fails. The attestor also embeds a single legacy global AWS public certificate and does not account for newer region specific certificates issued in 2024, making detection of forged documents difficult without additional trusted region data. An attacker able to supply or intercept instance identity document data (such as through Instance Metadata Service impersonation) can cause a forged identity document to be accepted, leading to incorrect trust decisions based on the attestation. This is fixed in go-witness 0.9.1 and witness 0.10.1. As a workaround, manually verify the included identity document, signature, and public key with standard tools (for example openssl) following AWS\u2019s verification guidance, or disable use of the AWS attestor until upgraded."
          },
          {
            "lang": "es",
            "value": "go-witness y witness son m\u00f3dulos Go para generar atestaciones. En las versiones 0.8.6 y anteriores de go-witness y las versiones 0.9.2 y anteriores de witness, el atestador de AWS verifica incorrectamente los documentos de identidad de instancia de AWS EC2. La verificaci\u00f3n puede tener \u00e9xito incorrectamente cuando una firma no est\u00e1 presente o est\u00e1 vac\u00eda, y cuando falla la verificaci\u00f3n de la firma RSA. El atestador tambi\u00e9n incrusta un \u00fanico certificado p\u00fablico global heredado de AWS y no tiene en cuenta los certificados m\u00e1s recientes espec\u00edficos de regi\u00f3n emitidos en 2024, lo que dificulta la detecci\u00f3n de documentos falsificados sin datos de regi\u00f3n confiables adicionales. Un atacante capaz de suministrar o interceptar datos de documentos de identidad de instancia (como a trav\u00e9s de la suplantaci\u00f3n del Servicio de Metadatos de Instancia) puede hacer que se acepte un documento de identidad falsificado, lo que lleva a decisiones de confianza incorrectas basadas en la atestaci\u00f3n. Esto se ha corregido en go-witness 0.9.1 y witness 0.10.1. Como soluci\u00f3n alternativa, verifique manualmente el documento de identidad, la firma y la clave p\u00fablica incluidos con herramientas est\u00e1ndar (por ejemplo, OpenSSL) siguiendo la gu\u00eda de verificaci\u00f3n de AWS, o deshabilite el uso del atestador de AWS hasta que se actualice."
          }
        ],
        "id": "CVE-2025-62375",
        "lastModified": "2026-10-08T11:10:00.250",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-62375",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-15T19:44:18.639906Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-10-15T20:15:36.670",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/in-toto/go-witness/commit/04ff20b600e28ce8fd1aa287534dd383a1cfefb9"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/in-toto/go-witness/security/advisories/GHSA-72c7-4g63-hpw5"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-295"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-27T13:41:15+00:00",
      "cve": "CVE-2025-62375",
      "id": "CVE-2025-62375",
      "initial_release_date": "2025-10-15T19:23:24.916000+00:00",
      "product_status:known_affected": "4",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "github.com/in-toto/go-witness: go-witness Improper Verification of AWS EC2 Identity Documents",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-62375.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-10T01:43:02Z",
      "cve": "CVE-2025-62375",
      "id": "CVE-2025-62375",
      "initial_release_date": "2025-11-09T00:23:25Z",
      "product_status:recommended": "1",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-62375",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-62375.json",
      "version": "5"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-62375",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-15T19:44:18.639906Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-15T19:44:24.928Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "go-witness",
              "vendor": "in-toto",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.9.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is not present or is empty, and when RSA signature verification fails. The attestor also embeds a single legacy global AWS public certificate and does not account for newer region specific certificates issued in 2024, making detection of forged documents difficult without additional trusted region data. An attacker able to supply or intercept instance identity document data (such as through Instance Metadata Service impersonation) can cause a forged identity document to be accepted, leading to incorrect trust decisions based on the attestation. This is fixed in go-witness 0.9.1 and witness 0.10.1. As a workaround, manually verify the included identity document, signature, and public key with standard tools (for example openssl) following AWS\u2019s verification guidance, or disable use of the AWS attestor until upgraded."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "LOW"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-295",
                  "description": "CWE-295: Improper Certificate Validation",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-10-15T19:23:24.916Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/in-toto/go-witness/security/advisories/GHSA-72c7-4g63-hpw5",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/in-toto/go-witness/security/advisories/GHSA-72c7-4g63-hpw5"
            },
            {
              "name": "https://github.com/in-toto/go-witness/commit/04ff20b600e28ce8fd1aa287534dd383a1cfefb9",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/in-toto/go-witness/commit/04ff20b600e28ce8fd1aa287534dd383a1cfefb9"
            }
          ],
          "source": {
            "advisory": "GHSA-72c7-4g63-hpw5",
            "discovery": "UNKNOWN"
          },
          "title": "go-witness Improper Verification of AWS EC2 Identity Documents"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-62375",
        "datePublished": "2025-10-15T19:23:24.916Z",
        "dateReserved": "2025-10-10T14:22:48.204Z",
        "dateUpdated": "2025-10-15T19:44:29.097Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CLEANSTART-2026-EM47790 (CVE-2025-15558)

Vulnerability from cleanstart – Published: 2026-09-01 11:17 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in tkn 0.42.2-r1

Details

Package tkn version 0.42.2-r1 fixes 57 vulnerabilities: CVE-2025-15558, CVE-2026-34040, CVE-2026-33997, CVE-2025-69725, CVE-2026-34986...

References

URL

Type

https://github.com/tektoncd/cli

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "tkn"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.42.2-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.42.2-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package tkn version 0.42.2-r1 fixes 57 vulnerabilities: CVE-2025-15558, CVE-2026-34040, CVE-2026-33997, CVE-2025-69725, CVE-2026-34986...",
  "id": "CLEANSTART-2026-EM47790",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-09-01T11:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tektoncd/cli"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in tkn 0.42.2-r1",
  "upstream": [
    "CVE-2025-15558",
    "CVE-2026-34040",
    "CVE-2026-33997",
    "CVE-2025-69725",
    "CVE-2026-34986",
    "ghsa-gcjh-h69q-9w9g",
    "CVE-2025-62375",
    "ghsa-pmwq-pjrm-6p5r",
    "CVE-2026-49478",
    "CVE-2026-22772",
    "CVE-2026-48702",
    "CVE-2026-23831",
    "CVE-2026-24117",
    "CVE-2026-54787",
    "CVE-2026-49834",
    "CVE-2026-49835",
    "CVE-2026-39984",
    "CVE-2026-2303",
    "CVE-2026-29181",
    "CVE-2026-39883",
    "CVE-2026-24051",
    "CVE-2026-39828",
    "CVE-2026-39829",
    "CVE-2026-39830",
    "CVE-2026-39831",
    "CVE-2026-39832",
    "CVE-2026-39835",
    "CVE-2026-42508",
    "CVE-2026-46595",
    "CVE-2026-46597",
    "CVE-2026-39827",
    "CVE-2026-39833",
    "CVE-2026-39834",
    "CVE-2026-33818",
    "CVE-2026-56853",
    "CVE-2026-56858",
    "CVE-2026-56859",
    "CVE-2026-56860",
    "CVE-2026-56862",
    "CVE-2026-46598",
    "CVE-2026-46600",
    "CVE-2026-25681",
    "CVE-2026-27136",
    "CVE-2026-39821",
    "CVE-2026-25680",
    "CVE-2026-42502",
    "CVE-2026-42506",
    "CVE-2026-33814",
    "CVE-2026-39824",
    "CVE-2026-56852",
    "ghsa-hrxh-6v49-42gf",
    "CVE-2026-56864",
    "CVE-2026-56865",
    "ghsa-259r-337f-4rfw",
    "ghsa-3fxj-6jh8-hvhx",
    "ghsa-9g5q-2w5x-hmxf",
    "ghsa-rjr7-jggh-pgcp"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

CLEANSTART-2026-EU40217 (CVE-2025-62375)

Vulnerability from cleanstart – Published: 2026-09-18 09:43 – Updated: 2026-10-08 19:00 – Source website

Summary

Security fix for CVE-2025-62375 applied in: tkn 0.42.2-r1

Details

Security vulnerability affects the tkn package. This issue is resolved in later releases. See references for vulnerability details.

Severity

6.9 (Medium)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2025-62375	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2025-62375	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "tkn",
        "purl": "pkg:apk/cleanstart/tkn"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.42.2-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Security vulnerability affects the tkn package. This issue is resolved in later releases. See references for vulnerability details.",
  "id": "CLEANSTART-2026-EU40217",
  "modified": "2026-10-08T19:00:57Z",
  "published": "2026-09-18T09:43:19.232972Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EU40217.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2025-62375"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62375"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Security fix for CVE-2025-62375 applied in: tkn 0.42.2-r1",
  "upstream": [
    "CVE-2025-62375"
  ]
}

FKIE_CVE-2025-62375

Vulnerability from fkie_nvd - Published: 2025-10-15 20:15 - Updated: 2026-10-08 11:10

Severity

6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/in-toto/go-witness/commit/04ff20b600e28ce8fd1aa287534dd383a1cfefb9
	security-advisories@github.com	https://github.com/in-toto/go-witness/security/advisories/GHSA-72c7-4g63-hpw5

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "go-witness",
          "vendor": "in-toto",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.9.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is not present or is empty, and when RSA signature verification fails. The attestor also embeds a single legacy global AWS public certificate and does not account for newer region specific certificates issued in 2024, making detection of forged documents difficult without additional trusted region data. An attacker able to supply or intercept instance identity document data (such as through Instance Metadata Service impersonation) can cause a forged identity document to be accepted, leading to incorrect trust decisions based on the attestation. This is fixed in go-witness 0.9.1 and witness 0.10.1. As a workaround, manually verify the included identity document, signature, and public key with standard tools (for example openssl) following AWS\u2019s verification guidance, or disable use of the AWS attestor until upgraded."
    },
    {
      "lang": "es",
      "value": "go-witness y witness son m\u00f3dulos Go para generar atestaciones. En las versiones 0.8.6 y anteriores de go-witness y las versiones 0.9.2 y anteriores de witness, el atestador de AWS verifica incorrectamente los documentos de identidad de instancia de AWS EC2. La verificaci\u00f3n puede tener \u00e9xito incorrectamente cuando una firma no est\u00e1 presente o est\u00e1 vac\u00eda, y cuando falla la verificaci\u00f3n de la firma RSA. El atestador tambi\u00e9n incrusta un \u00fanico certificado p\u00fablico global heredado de AWS y no tiene en cuenta los certificados m\u00e1s recientes espec\u00edficos de regi\u00f3n emitidos en 2024, lo que dificulta la detecci\u00f3n de documentos falsificados sin datos de regi\u00f3n confiables adicionales. Un atacante capaz de suministrar o interceptar datos de documentos de identidad de instancia (como a trav\u00e9s de la suplantaci\u00f3n del Servicio de Metadatos de Instancia) puede hacer que se acepte un documento de identidad falsificado, lo que lleva a decisiones de confianza incorrectas basadas en la atestaci\u00f3n. Esto se ha corregido en go-witness 0.9.1 y witness 0.10.1. Como soluci\u00f3n alternativa, verifique manualmente el documento de identidad, la firma y la clave p\u00fablica incluidos con herramientas est\u00e1ndar (por ejemplo, OpenSSL) siguiendo la gu\u00eda de verificaci\u00f3n de AWS, o deshabilite el uso del atestador de AWS hasta que se actualice."
    }
  ],
  "id": "CVE-2025-62375",
  "lastModified": "2026-10-08T11:10:00.250",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-62375",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-10-15T19:44:18.639906Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-10-15T20:15:36.670",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/in-toto/go-witness/commit/04ff20b600e28ce8fd1aa287534dd383a1cfefb9"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/in-toto/go-witness/security/advisories/GHSA-72c7-4g63-hpw5"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-72C7-4G63-HPW5

Vulnerability from github – Published: 2025-10-15 20:12 – Updated: 2025-10-16 14:43

Summary

go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents

Details

Impact

This vulnerability only affects users of the AWS attestor.

Users of the AWS attestor could have unknowingly received a forged identity document. While this may seem unlikely, AWS recently issued a security bulletin about IMDS (Instance Metadata Service) impersonation.[^1]

There are multiple locations where the verification of the identity document will mistakenly report a successful verification.

If a signature is not present or is empty https://github.com/in-toto/go-witness/blob/0c8bb30c143951d88b1d4b32f260c5f67d30137b/attestation/aws-iid/aws-iid.go#L161-L163
If the RSA verification of the document fails for any reason https://github.com/in-toto/go-witness/blob/0c8bb30c143951d88b1d4b32f260c5f67d30137b/attestation/aws-iid/aws-iid.go#L192-L196

Workarounds

The contents of the AWS attestation contain the identity document, signature, and public key that was used to verify the document. These attestations and their could be identity documents could be manually verified with the openssl command line as documented in the below reference from AWS.[^2]

However, the certificate containing the public key was hard-coded into the attestor. https://github.com/in-toto/go-witness/blob/0c8bb30c143951d88b1d4b32f260c5f67d30137b/attestation/aws-iid/aws-iid.go#L46-L66

Since the original authoring of the attestor, AWS has moved to region specific public certificates. The currently valid certificates were issued around April of 2024, making the identification of attestations with forged content difficult without additional trusted data proving the AWS region in which the attestation was created.

Patches

This vulnerability is addressed in go-witness 0.9.1 and witness 0.10.1.

Resources

[^1]: AWS Security Bulletin on IMDS Impersonation [^2]: Verification of instance identity documents

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/in-toto/go-witness"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-62375"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-15T20:12:56Z",
    "nvd_published_at": "2025-10-15T20:15:36Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nThis vulnerability only affects users of the AWS attestor.\n\nUsers of the AWS attestor could have unknowingly received a forged identity document. While this may seem unlikely, AWS recently issued a security bulletin about IMDS (Instance Metadata Service) impersonation.[^1]\n\nThere are multiple locations where the verification of the identity document will mistakenly report a successful verification.\n\n- If a signature is not present or is empty\nhttps://github.com/in-toto/go-witness/blob/0c8bb30c143951d88b1d4b32f260c5f67d30137b/attestation/aws-iid/aws-iid.go#L161-L163\n\n- If the RSA verification of the document fails for any reason\nhttps://github.com/in-toto/go-witness/blob/0c8bb30c143951d88b1d4b32f260c5f67d30137b/attestation/aws-iid/aws-iid.go#L192-L196\n\n### Workarounds\nThe contents of the AWS attestation contain the identity document, signature, and public key that was used to verify the document. These attestations and their could be identity documents could be manually verified with the `openssl` command line as documented in the below reference from AWS.[^2]\n\nHowever, the certificate containing the public key was hard-coded into the attestor. \nhttps://github.com/in-toto/go-witness/blob/0c8bb30c143951d88b1d4b32f260c5f67d30137b/attestation/aws-iid/aws-iid.go#L46-L66\n\nSince the original authoring of the attestor, AWS has moved to region specific public certificates. The currently valid certificates were issued around April of 2024, making the identification of attestations with forged content difficult without additional trusted data proving the AWS region in which the attestation was created.\n\n### Patches\nThis vulnerability is addressed in `go-witness` 0.9.1 and `witness` 0.10.1.\n\n### Resources\n[^1]: [AWS Security Bulletin on IMDS Impersonation](https://aws.amazon.com/security/security-bulletins/rss/aws-2025-021/)\n[^2]: [Verification of instance identity documents](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/verify-iid.html#verify-signature)",
  "id": "GHSA-72c7-4g63-hpw5",
  "modified": "2025-10-16T14:43:47Z",
  "published": "2025-10-15T20:12:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/in-toto/go-witness/security/advisories/GHSA-72c7-4g63-hpw5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62375"
    },
    {
      "type": "WEB",
      "url": "https://github.com/in-toto/go-witness/commit/04ff20b600e28ce8fd1aa287534dd383a1cfefb9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/in-toto/go-witness"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents"
}

OPENSUSE-SU-2025:15710-1

Vulnerability from csaf_opensuse - Published: 2025-11-07 00:00 - Updated: 2026-09-20 21:44

Summary

govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media

Severity

Moderate

Scope

70 vulnerabilities in this advisory, including CVE-2025-62375.

CVE-2025-62375

Recommended: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-62375 (GCVE-0-2025-62375)

CLEANSTART-2026-EM47790 (CVE-2025-15558)

CLEANSTART-2026-EU40217 (CVE-2025-62375)

FKIE_CVE-2025-62375

GHSA-72C7-4G63-HPW5

Impact

Workarounds

Patches

Resources

OPENSUSE-SU-2025:15710-1

Tags

Sightings

Nomenclature

Related by attack behaviour