CVE-2022-1740 2.2.2 MUTABLE ATTESTATION OR MEASUREMENT REPORTING DATA CWE-1283

The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality rely on self-attestation mechanisms. An attacker could leverage this vulnerability to disguise malicious applications on a device...

CVE-2022-1740 2.2.2 MUTABLE ATTESTATION OR MEASUREMENT REPORTING DATA CWE-1283

The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality rely on self-attestation mechanisms. An attacker could leverage this vulnerability to disguise malicious applications on a device...

CVE-2022-1740

The CVE-2022-1740 vulnerability in Dominion Voting Systems ImageCast X concerns the on-screen hash display, audit log export, and application export features that rely on self-attestation. The root cause is mutable attestation/measurement data, allowing an attacker with access to disguise malicio...

MAL-2022-4153 Malicious code in keyvault-mock-attestation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 343541e6f4209b857efb3416d3152bbabb5d12bd0e0cf285ab16c3b4292ad6a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in keyvault-mock-attestation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 343541e6f4209b857efb3416d3152bbabb5d12bd0e0cf285ab16c3b4292ad6a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in arm-attestation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68ca3369e2fafc9c53e0e29146ebd4d60493a8765224a59c81a07a4f3af6e0b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1098 Malicious code in arm-attestation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68ca3369e2fafc9c53e0e29146ebd4d60493a8765224a59c81a07a4f3af6e0b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-2970 · Intel +9 · Sgx Psw +12

Name of the Vulnerable Software and Affected Versions: IntelR Processors affected versions not specified Description: The issue is related to incomplete cleanup in specific special register write operations, which may allow an authenticated user to potentially enable information disclosure via...

Vulnerabilities Affecting Dominion Voting Systems ImageCast X

1. SUMMARY This advisory identifies vulnerabilities affecting versions of the Dominion Voting Systems Democracy Suite ImageCast X, which is an in-person voting system used to allow voters to mark their ballot. The ImageCast X can be configured to allow a voter to produce a paper record or to...

PT-2022-3368

Name of the Vulnerable Software and Affected Versions Dominion Voting Systems ImageCast X affected versions not specified Description The issue concerns the on-screen application hash display feature, audit log export, and application export functionality of Dominion Voting Systems ImageCast X,...

[SECURITY] Fedora 35 Update: keylime-6.4.0-1.fc35

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution...

Fedora: Security Advisory for keylime (FEDORA-2022-748fda10e7)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: keylime-6.4.0-1.fc36

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution...

PYSEC-2022-184

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an...

CVE-2022-0317

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

Input validation

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

CVE-2022-0317 Improper Input Validation in AKPublic.Verify in go-attestation

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

CVE-2022-0317 Improper Input Validation in AKPublic.Verify in go-attestation

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

CVE-2022-0317 Improper Input Validation in AKPublic.Verify in go-attestation

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

CVE-2022-0317

The CVE-2022-0317 issue affects go-attestation prior to 0.4.0. A local attacker can craft a malicious Quote with no/some PCRs that makes AKPublic.Verify succeed, then reuse the same PCR set in Eventlog.Verify to spoof TCG log events and defeat remotely-attested measured-boot. Public advisories (G...