High · published November 13, 2025
⚡ A sneaky flaw in the `evervault-go` SDK’s verification logic could let incomplete documents slip through, undermining payment security! 🔒 Think of it like a restaurant that lets diners order without checking if the ingredients meet safety standards — you might not notice until someone gets sick! If exploited, this vulnerability could lead to trusting an enclave operator that doesn't meet integrity guarantees, potentially exposing sensitive payment information. The worst-case scenario? An attacker could manipulate the trust process, resulting in data breaches that affect user privacy and financial security — absolutely devastating!
Think of it like a restaurant that lets diners order without checking if the ingredients meet safety standards — you might not notice until someone gets sick! This vulnerability in `evervault-go` allows incomplete attestation documents to pass validation due to faulty logic in checking PCR values, specifically PCR8. The flaw can mislead applications into trusting potentially malicious operators.
If exploited, this vulnerability could lead to trusting an enclave operator that doesn't meet integrity guarantees, potentially exposing sensitive payment information. The worst-case scenario? An attacker could manipulate the trust process, resulting in data breaches that affect user privacy and financial security — absolutely devastating! To secure your application, upgrade to version 1.3.2 immediately to ensure proper validation of attestation documents. If you can't upgrade, modify your application to fail verification if PCR8 is missing or empty, and implement custom pre-validation to reject documents with any required PCRs omitted. 🛡️ You've got this! Follow these steps and you'll have your payment security fortified in no time! 💪
| Product | Versions | Fixed in |
|---|---|---|
| evervault/evervault | < 1.3.2 | 1.3.2 |