27 matches found
trivy-plugin-attest
trivy-plugin-attest 发布 SBOM 证明 安装 root@kitploit: $ trivy plugin install github.com/aquasecurity/trivy-plugin-attest 用法 root@kitploit: A Trivy plugin that publish SBOM attestation Usage: attest flags Examples: trivy attest --type PREDICATETYPE --predicate PREDICATEPATH BLOBPATH Publish SBOM...
CVE-2026-80571
A flaw was found in the Linux kernel's powerpc/pseries: papr-phy-attest component. This vulnerability arises from insufficient validation of a command length parameter, which can lead to a buffer overflow. Such an overflow could be exploited by a local attacker to potentially execute arbitrary co...
CVE-2026-80571
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In paprphyattestcreatehandle, the params-cmd.length is not validated before use, which can result in a buffer overlow. Check it and return -EINVAL if it is...
UBUNTU-CVE-2026-80571
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In paprphyattestcreatehandle, the params-cmd.length is not validated before use, which can result in a buffer overlow. Check it and return -EINVAL if it is...
CVE-2026-80571
CVE-2026-80571 affects the Linux kernel on powerpc/pseries systems, specifically the papr-phy-attest driver. In the function papr_phy_attest_create_handle() , the field params->cmd.length is not validated before use, which can result in a buffer overflow . The driver also fails to free params ...
CVE-2026-80571 powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In paprphyattestcreatehandle, the params-cmd.length is not validated before use, which can result in a buffer overlow. Check it and return -EINVAL if it is...
PT-2026-82187
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the papr phy attest create handle function where the params-cmd.length variable is not validated before use, potentially leading to a buffer overflow. Additionally, a...
Linux Distros Unpatched Vulnerability : CVE-2026-80571
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In paprphyattestcreatehandle, the params-cmd.length is not validated before use, which can...
sshkey-attest (0.5.0), uvb-factors (0.2.1) +3 more potentially affected by unknown CVE via webauthn-rs-core (>=0.4.9, <=0.5.0)
webauthn-rs-core CARGO version =0.4.9, =0.1.0, =0.4.1-beta.2, =0.5.0 Source cves: unknown CVE Source advisory: OSV:GHSA-22W3-693W-X895...
CVE-2026-40097 Step CA affected by an index out of bounds panic in TPM attestation EKU validation
Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key AK certificate with an empty Extended Key Usage EKU extension...
CVE-2026-40097
CVE-2026-40097 affects Step CA (online CA for secure, automated certificate management). From version 0.24.0 up to before 0.30.0-rc3, an attacker can trigger an index-out-of-bounds panic during TPM device attestation by sending a crafted attestation key certificate with an empty EKU extension. Sp...
PT-2026-31991
Name of the Vulnerable Software and Affected Versions Step CA versions 0.24.0 through 0.30.0-rc3 Description An attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key AK certificate with an empty Extended Key Usage EKU extension during TPM device...
MiracleLinux 9 : tpm2-tools-5.2-4.el9 (AXSA:2024-9175:01)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-9175:01 advisory. tpm2-tools: arbitrary quote data may go undetected by tpm2checkquote CVE-2024-29038 tpm2-tools: pcr selection value is not compared with the attest...
SUSE-SU-2025:02592-1 Security update for cosign
This update for cosign fixes the following issues: Update to version 2.5.3 jscSLE-23879: - CVE-2025-46569: Fixed OPA server Data API HTTP path injection of Rego bsc1246725 Changelog: Update to 2.5.3: - Add signing-config create command 4280 - Allow multiple services to be specified for trusted-ro...
tpm2-tools: pcr selection value is not compared with the attest
A flaw was found in tpm2-tools. The PCR selection, which is passed with the --pcr parameter, is not compared with the attest, making it possible for an attacker to fake a valid attestation...
AZL-42978 CVE-2024-29040 affecting package tpm2-tss for versions less than 4.0.2-1
This repository hosts source code implementing the Trusted Computing Group's TCG TPM2 Software Stack TSS. The JSON Quote Info returned by FapiQuote has to be deserialized by FapiVerifyQuote to the TPM Structure TPMSATTEST. For the field TPM2GENERATED magic of this structure any number can be used...
OESA-2024-1638 tpm2-tss security update
tpm2-tss is a software stack supporting Trusted Platform ModuleTPM 2.0 system APIs which provides TPM2.0 specified APIs for applications to access TPM module through kernel TPM drivers. Security Fixes: A flaw was found in the tpm2-tss package, where it was not checked to see if the magic number i...
OESA-2024-1637 tpm2-tss security update
tpm2-tss is a software stack supporting Trusted Platform ModuleTPM 2.0 system APIs which provides TPM2.0 specified APIs for applications to access TPM module through kernel TPM drivers. Security Fixes: A flaw was found in the tpm2-tss package, where it was not checked to see if the magic number i...
PT-2024-4042 · Unknown +5 · Tpm2 Software Stack +5
Name of the Vulnerable Software and Affected Versions: TPM2 Software Stack versions prior to 4.1.0 Description: The issue is related to the TPM2 GENERATED VALUE function in the TCG TPM2 TPM2 Software Stack implementation. It lacks a check to ensure the magic number in the attest matches the TPM2...
