RUSTSEC-2026-0481

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0481

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0481.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0481

Aliases

CVE-2026-42067
GHSA-w4mf-755j-wjwc

Published

2026-11-10T12:00:00Z

Modified

2026-11-11T08:45:02Z

Severity

5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

`verify_x509_cert` does not check the certificate validity period

Details

tdx_workload_attestation::verification::x509::verify_x509_cert(), available with the host-verification feature, checked that issuer_cert issued cert and verified the certificate signature. It did not check the certificate's validity period, so it accepted expired and not-yet-valid certificates.

With the host-gcp-tdx feature, this function validates the GCP launch endorsement signing certificate against the GCE confidential-computing TCB root certificate. A signing certificate outside its validity period was therefore still accepted during launch endorsement verification.

Intel describes the issue as improper certificate validation and classifies it as escalation of privilege, with a CVSS 4.0 base score of 5.9, in INTEL-SA-01520.

The flaw was corrected in #86, released in 0.2.0. The function now returns Ok(false) when the current time is outside the certificate's notBefore/notAfter range.

Reported by Borys Tsyrulnikov.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / tdx_workload_attestation

Package

Name: tdx_workload_attestation; View open source insights on deps.dev
Purl: pkg:cargo/tdx_workload_attestation

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.2.0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "tdx_workload_attestation::verification::x509::verify_x509_cert"
        ],
        "os": []
    }
}