Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

sgx-dcap-quote-verify-python

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedPyPIAmendedPublished

    Vulnerable OpenSSL included in sgx-dcap-quote-verify-python

    GHSA-344m-qcjq-xgrf

    Affected
    • PyPI sgx-dcap-quote-verify-python < 0.0.3
    Fixed in
    0.0.3· Vendor fix available
    Issue
    sgx-dcap-quote-verify-python includes a statically linked copy of OpenSSL. The version of OpenSSL included in sgx-dcap-quote-verify-python 0.0.1..0.0.2 is vulnerable to a security issue. More details about the OpenSSL vulnerabilities themselves can be found at https://www.openssl.org/news/secadv/20230207.txt. Analysis The binding includes OpenSSL version 1.1.1s which is vulnerable to the vulnerabilities disclosed in OpenSSL Security Advisory from the 7th February 2023. The binding does not directly use OpenSSL. The binding calls the SGX Quote Verification Library which uses OpenSSL. Explanation The SGX Quote Verification Library uses OpenSSL as a dependency to perform its cryptographic operations and certificate verification. The OpenSSL security advisory mentions multiple vulnerabilities but I believe the most concerning would be CVE-2023-0286 “X.400 address type confusion in X.509 GeneralName”. Its severity is rated high and the advisory states that “this vulnerability is most…

    Recommended action: Upgrade to 0.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →