PT-2025-42399 · Witness+1 · Witness+1

Published 2025-10-15 · Updated 2025-11-07 · CVE-2025-62375

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions go-witness versions 0.8.6 and earlier witness versions 0.9.2 and earlier

Description The AWS attestor in go-witness and witness improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is not present or is empty, and when RSA signature verification fails. The attestor embeds a single legacy global AWS public certificate and does not account for newer region-specific certificates issued in 2024, making detection of forged documents difficult without additional trusted region data. An attacker able to supply or intercept instance identity document data can cause a forged identity document to be accepted, leading to incorrect trust decisions based on the attestation.

Recommendations Update go-witness to version 0.9.1 or later. Update witness to version 0.10.1 or later. Manually verify the included identity document, signature, and public key with standard tools following AWS’s verification guidance. Disable use of the AWS attestor until upgraded.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2025-62375

GHSA-72C7-4G63-HPW5

GO-2025-4028

OPENSUSE-SU-2025:15710-1

Affected Products

Gowitness

Witness

References · 83

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62375.json · Exploit
• https://osv.dev/vulnerability/GO-2025-4028 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62375 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62375 · Security Note
• https://osv.dev/vulnerability/GHSA-72c7-4g63-hpw5 · Vendor Advisory
• https://github.com/in-toto/go-witness/security/advisories/GHSA-72c7-4g63-hpw5 · Note
• https://github.com/in-toto/go-witness/commit/04ff20b600e28ce8fd1aa287534dd383a1cfefb9 · Note
• https://github.com/in-toto/go-witness · Note
• https://suse.com/security/cve/CVE-2025-58073 · Note
• https://suse.com/security/cve/CVE-2016-11067 · Note
• https://suse.com/security/cve/CVE-2016-11078 · Note
• https://suse.com/security/cve/CVE-2025-59043 · Note
• https://suse.com/security/cve/CVE-2025-11375 · Note
• https://suse.com/security/cve/CVE-2025-54471 · Note