Homepage

sgx-dcap-quote-verify-python@0.0.2

Python package to verify Intel SGX ECDSA-based quotes

  • latest version

    0.0.3

  • latest non vulnerable version

    0.0.3

  • first published

    3 years ago

  • latest version published

    3 years ago

  • licenses detected

  • View sgx-dcap-quote-verify-python package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the sgx-dcap-quote-verify-python package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Access of Resource Using Incompatible Type ('Type Confusion')

    sgx-dcap-quote-verify-python is a Python binding to the SGX Quote Verification Library (QVL), which is the reference implementation of ECDSA-based SGX quote verification. It allows you to verify ECDSA-based quotes generated by the Intel provided Quoting Enclave in Python.

    Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') in x509/v3_genn.c, when processing X.400 addresses with CRL checking enabled (e.g. when X509_V_FLAG_CRL_CHECK is set). An attacker in possession of both the certificate chain and CRL, of which neither needs a valid signature, can expose memory or cause a denial of service. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon.

    How to fix Access of Resource Using Incompatible Type ('Type Confusion')?

    Upgrade sgx-dcap-quote-verify-python to version 0.0.3 or higher.

    [,0.0.3)
    Go back to all versions of this package