Skip to content
OpenAdvisories

Package · Go

github.com/google/go-attestation

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.9
    CVE-2026-12681

    Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()

    Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-contro…

    Google go-attestation golang-github-google-go-attestation github.com/google/go-attestation Debian Ubuntu Go
  • Medium 4.0
    CVE-2022-0317

    Improper Input Validation in AKPublic.Verify in go-attestation

    An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in…

    Google go-attestation github.com/google/go-attestation Go