CVE-2025-61779

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-61779", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-30T19:43:49.901Z", "datePublished": "2025-10-09T20:53:33.855Z", "dateUpdated": "2025-10-10T14:32:49.097Z"}, "containers": {"cna": {"title": "Trustee's attestation-policy endpoint is not protected by admin autentication", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/confidential-containers/trustee/security/advisories/GHSA-49mc-2q77-m99x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/confidential-containers/trustee/security/advisories/GHSA-49mc-2q77-m99x"}, {"name": "https://github.com/confidential-containers/trustee/pull/957", "tags": ["x_refsource_MISC"], "url": "https://github.com/confidential-containers/trustee/pull/957"}, {"name": "https://github.com/confidential-containers/trustee/commit/3a7d04a70918fa503a00974dcae653cf9f0640e0", "tags": ["x_refsource_MISC"], "url": "https://github.com/confidential-containers/trustee/commit/3a7d04a70918fa503a00974dcae653cf9f0640e0"}], "affected": [{"vendor": "confidential-containers", "product": "trustee", "versions": [{"version": "< 0.15.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-09T20:53:33.855Z"}, "descriptions": [{"lang": "en", "value": "Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0.15.0, the attestation-policy endpoint didn't check if the kbs-client submitting the request was actually authenticated (had the right key). This allowed any kbs-client to actually change the attestation policy. Version 0.15.0 fixes the issue."}], "source": {"advisory": "GHSA-49mc-2q77-m99x", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/confidential-containers/trustee/security/advisories/GHSA-49mc-2q77-m99x", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-10T14:32:46.403550Z", "id": "CVE-2025-61779", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-10T14:32:49.097Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-61779", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-10T14:32:46.403550Z"}}}], "references": [{"url": "https://github.com/confidential-containers/trustee/security/advisories/GHSA-49mc-2q77-m99x", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-10T14:32:38.952Z"}}], "cna": {"title": "Trustee's attestation-policy endpoint is not protected by admin autentication", "source": {"advisory": "GHSA-49mc-2q77-m99x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "confidential-containers", "product": "trustee", "versions": [{"status": "affected", "version": "< 0.15.0"}]}], "references": [{"url": "https://github.com/confidential-containers/trustee/security/advisories/GHSA-49mc-2q77-m99x", "name": "https://github.com/confidential-containers/trustee/security/advisories/GHSA-49mc-2q77-m99x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/confidential-containers/trustee/pull/957", "name": "https://github.com/confidential-containers/trustee/pull/957", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/confidential-containers/trustee/commit/3a7d04a70918fa503a00974dcae653cf9f0640e0", "name": "https://github.com/confidential-containers/trustee/commit/3a7d04a70918fa503a00974dcae653cf9f0640e0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0.15.0, the attestation-policy endpoint didn't check if the kbs-client submitting the request was actually authenticated (had the right key). This allowed any kbs-client to actually change the attestation policy. Version 0.15.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-09T20:53:33.855Z"}}}, "cveMetadata": {"cveId": "CVE-2025-61779", "state": "PUBLISHED", "dateUpdated": "2025-10-10T14:32:49.097Z", "dateReserved": "2025-09-30T19:43:49.901Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-09T20:53:33.855Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "trustee", "vendor": "confidential-containers", "versions": [{"status": "affected", "version": "< 0.15.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0.15.0, the attestation-policy endpoint didn't check if the kbs-client submitting the request was actually authenticated (had the right key). This allowed any kbs-client to actually change the attestation policy. Version 0.15.0 fixes the issue."}, {"lang": "es", "value": "El proyecto Trustee de Confidential Containers contiene herramientas y componentes para atestiguar invitados confidenciales y proporcionarles secretos. En versiones anteriores a la 0.15.0, el endpoint de pol\u00edtica de atestaci\u00f3n no verificaba si el kbs-cliente que enviaba la solicitud estaba realmente autenticado (ten\u00eda la clave correcta). Esto permit\u00eda a cualquier kbs-cliente cambiar realmente la pol\u00edtica de atestaci\u00f3n. La versi\u00f3n 0.15.0 corrige el problema."}], "id": "CVE-2025-61779", "lastModified": "2026-10-08T13:10:00.200", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61779", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-10T14:32:46.403550Z", "version": "2.0.3"}}]}, "published": "2025-10-09T21:15:39.960", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/confidential-containers/trustee/commit/3a7d04a70918fa503a00974dcae653cf9f0640e0"}, {"source": "security-advisories@github.com", "url": "https://github.com/confidential-containers/trustee/pull/957"}, {"source": "security-advisories@github.com", "url": "https://github.com/confidential-containers/trustee/security/advisories/GHSA-49mc-2q77-m99x"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/confidential-containers/trustee/security/advisories/GHSA-49mc-2q77-m99x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "trustee: Trustee's attestation-policy endpoint missing autentication", "id": "2402931", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402931"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "status": "draft"}, "cwe": "CWE-639", "details": ["Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0.15.0, the attestation-policy endpoint didn't check if the kbs-client submitting the request was actually authenticated (had the right key). This allowed any kbs-client to actually change the attestation policy. Version 0.15.0 fixes the issue."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-61779", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "trustee-guest-components", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "trustee-guest-components", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-10-09T20:53:33Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-61779\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-61779\nhttps://github.com/confidential-containers/trustee/commit/3a7d04a70918fa503a00974dcae653cf9f0640e0\nhttps://github.com/confidential-containers/trustee/pull/957\nhttps://github.com/confidential-containers/trustee/security/advisories/GHSA-49mc-2q77-m99x"], "threat_severity": "Important"}

{"created": "2025-10-10T11:17:35.939806+00:00", "updated": "2025-10-10T11:17:35.939831+00:00", "vendors": ["confidential-containers", "confidential-containers$PRODUCT$trustee"]}