{"id":"RUSTSEC-2026-0481","summary":"`verify_x509_cert` does not check the certificate validity period","details":"`tdx_workload_attestation::verification::x509::verify_x509_cert()`, available\nwith the `host-verification` feature, checked that `issuer_cert` issued `cert`\nand verified the certificate signature. It did not check the certificate's\nvalidity period, so it accepted expired and not-yet-valid certificates.\n\nWith the `host-gcp-tdx` feature, this function validates the GCP launch\nendorsement signing certificate against the GCE confidential-computing TCB\nroot certificate. A signing certificate outside its validity period was\ntherefore still accepted during launch endorsement verification.\n\nIntel describes the issue as improper certificate validation and classifies\nit as escalation of privilege, with a CVSS 4.0 base score of 5.9, in\nINTEL-SA-01520.\n\nThe flaw was corrected in\n[#86](https://github.com/IntelLabs/tdx-workload-attestation/pull/86), released\nin 0.2.0. The function now returns `Ok(false)` when the current time is\noutside the certificate's `notBefore`/`notAfter` range.\n\nReported by [Borys Tsyrulnikov](https://borystsyrulnikov.dev).","aliases":["CVE-2026-42067","GHSA-w4mf-755j-wjwc"],"modified":"2026-11-11T08:45:02.484411857Z","published":"2026-11-10T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/tdx_workload_attestation"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0481.html"},{"type":"WEB","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01520.html"},{"type":"WEB","url":"https://github.com/IntelLabs/tdx-workload-attestation/pull/86"},{"type":"WEB","url":"https://github.com/IntelLabs/tdx-workload-attestation/releases/tag/v0.2.0"}],"affected":[{"package":{"name":"tdx_workload_attestation","ecosystem":"crates.io","purl":"pkg:cargo/tdx_workload_attestation"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.2.0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"os":[],"functions":["tdx_workload_attestation::verification::x509::verify_x509_cert"],"arch":[]}},"database_specific":{"categories":["crypto-failure"],"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0481.json","cvss":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","informational":null}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}