CVE-2024-51997

Summary

CVE-2024-51997 is a vulnerability affecting Trustee, a toolset for attesting confidential guests and providing secrets. An attacker can manipulate the ART (Attestation Results Token) token during transmission, replacing the genuine public key ('jwk') with their own. The attacker can then sign the altered ART token using their private key, making it indistinguishable from the original for the verifier. This vulnerability, which allows an MITM (Man-in-the-Middle) attack, was first identified in Trustee version 0.8.0. The issue has been resolved in version 0.8.2, and all users are encouraged to upgrade as soon as possible. Unfortunately, there are currently no known workarounds for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.