Detections
Analytics

SCA: security update for github.com/in-toto/go-witness (GHSA-72c7-4g63-hpw5)

medium Tenable Self-Hosted Container Security Plugin ID 435632

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and
 earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance
 identity documents. Verification can incorrectly succeed when a signature is not present or is empty, and
 when RSA signature verification fails. The attestor also embeds a single legacy global AWS public
 certificate and does not account for newer region specific certificates issued in 2024, making detection
 of forged documents difficult without additional trusted region data. An attacker able to supply or
 intercept instance identity document data (such as through Instance Metadata Service impersonation) can
 cause a forged identity document to be accepted, leading to incorrect trust decisions based on the
 attestation. This is fixed in go-witness 0.9.1 and witness 0.10.1. As a workaround, manually verify the
 included identity document, signature, and public key with standard tools (for example openssl) following
 AWS’s verification guidance, or disable use of the AWS attestor until upgraded. (CVE-2025-62375)

See Also

https://github.com/advisories/GHSA-72c7-4g63-hpw5

Plugin Details

Severity: Medium

ID: 435632

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 10/16/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.92

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2025-62375

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/15/2025

Vulnerability Publication Date: 10/15/2025

Reference Information

CVE: CVE-2025-62375

cwe: CWE-295