CVE-2025-62375
BaseFortify
Publication date: 2025-10-15
Last updated on: 2025-10-16
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| in-toto | go-witness | 0.8.6 |
| in-toto | witness | 0.9.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the AWS attestor in go-witness (<=0.8.6) and witness (<=0.9.2) Go modules, which improperly verify AWS EC2 instance identity documents. The verification can incorrectly succeed even when the signature is missing, empty, or when RSA signature verification fails. Additionally, the attestor uses a single legacy global AWS public certificate and does not recognize newer region-specific certificates issued in 2024. This flaw allows an attacker who can supply or intercept instance identity document data (e.g., via Instance Metadata Service impersonation) to have forged identity documents accepted, leading to incorrect trust decisions based on the attestation.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to present forged AWS EC2 instance identity documents that are accepted as valid. This can lead to incorrect trust decisions, potentially allowing unauthorized access or actions based on false attestations of instance identity. This undermines the security of systems relying on these attestations for authentication or authorization.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by manually verifying the included AWS EC2 instance identity document, its signature, and the public key using standard tools such as openssl, following AWS's verification guidance. There are no specific commands provided, but using openssl to check the signature validity against trusted certificates is recommended.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading to go-witness version 0.9.1 or later, or witness version 0.10.1 or later. As a workaround, you can manually verify the identity document, signature, and public key with standard tools like openssl following AWS's verification guidance, or disable the use of the AWS attestor until the upgrade is applied.