Skip to content
OpenAdvisories

Package · Go

github.com/edgelesssys/marblerun

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.1
    GHSA-w7wm-2425-7p2h

    MarbleRun unauthenticated recovery allows Coordinator impersonation

    ### Impact During recovery, a Coordinator only verifies that a given recovery key decrypts the sealed state, not if this key was provided by a party with access to one of the recovery keys defined in the manifest. This allows an attacker to manually craft a s…

    github.com/edgelesssys/marblerun Go
  • Critical 9.1
    GHSA-x5r5-2qrx-rqj8

    Transparent TLS may not be applied to Marbles with certain manifest configurations

    Transparent TLS (TTLS) is a MarbleRun feature that wraps plain TCP connections between Marbles in TLS. In the manifest, a user defines the connections that should be considered. ### Impact If a Marble is configured for TTLS, but doesn't have an environment va…

    github.com/edgelesssys/marblerun Go
  • High —
    GHSA-j3rq-4xjw-xg63

    Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks

    ### Impact Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest. ### Patches The issue has been pat…

    github.com/edgelesssys/marblerun Go