Skip to content
OpenAdvisories

Package · Go

github.com/edgelesssys/marblerun

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    GHSA-w7wm-2425-7p2h

    MarbleRun unauthenticated recovery allows Coordinator impersonation

    ### Impact During recovery, a Coordinator only verifies that a given recovery key decrypts the sealed state, not if this key was provided by a party with access to one of the recovery keys defined in the manifest. This allows an attacker to manually craft a s…

    github.com/edgelesssys/marblerun Go
  • High —
    GHSA-j3rq-4xjw-xg63

    Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks

    ### Impact Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest. ### Patches The issue has been pat…

    github.com/edgelesssys/marblerun Go