Cpe:2.3:a:ccc_attestation_sig:attested-Tls-Poc:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3accc_attestation_sigattested-tls-poc/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 19 Oct 2026 20:11:52 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-112377: Cryptographic Relay Vulnerability in attested-tls-pochttps://feed.craftedsignal.io/briefs/2026-10-attested-tls-relay/Mon, 19 Oct 2026 20:11:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-attested-tls-relay/The attested-tls-poc library fails to bind attestation evidence to TLS connections, enabling attackers to relay valid evidence to impersonate workloads and intercept sensitive data.CVE-2026-112377 affects the CCC Attestation SIG attested-tls-poc library up to commit 731ca82. The vulnerability arises from an implementation flaw where early attestation evidence is not cryptographically bound to the resulting TLS connection. Because the evidence is loosely coupled with the session, an attacker who has managed to extract an attested TLS private key can perform relay or replay attacks. By intercepting a relying party's nonce and forwarding it to a legitimate, genuine attester, the attacker can force the attester to sign the nonce. The attacker then uses the resulting valid evidence to successfully impersonate the original, legitimate attested workload during a TLS handshake. This allows for unauthorized session establishment and potential interception of data intended for the genuine service. This flaw represents a critical failure in the intended security properties of remote attestation within this library.

Attack Chain

  1. Attacker gains unauthorized access to the environment where the target workload resides.
  2. Attacker extracts the attested TLS private key from the target application's memory or insecure storage.
  3. Attacker intercepts a TLS handshake attempt between a relying party and the target workload.
  4. Attacker initiates a separate connection to a legitimate, genuine attester.
  5. Attacker relays the relying party's original nonce to the genuine attester.
  6. Attacker collects the resulting valid attestation evidence generated by the genuine attester.
  7. Attacker completes the handshake with the relying party using the extracted private key and the replayed attestation evidence.
  8. Attacker establishes a rogue TLS session, enabling data interception and impersonation.

Impact

Successful exploitation allows an attacker to impersonate an attested workload, effectively bypassing the security assurances provided by remote attestation. This leads to the potential for unauthorized data interception, manipulation, or man-in-the-middle attacks on the communication channels protected by the library.

Recommendation

Prioritize the immediate update of the attested-tls-poc library. Ensure all deployments move beyond commit 731ca82 and apply any security patches provided by the CCC Attestation SIG to remediate CVE-2026-112377. Given the sensitive nature of these keys, perform an audit of secret storage and memory-protection policies for all workloads utilizing attested-tls-poc to prevent key extraction.

]]>highadvisorycryptographic-vulnerabilitytls-relayattestation