What is CVE-2025-62375?

CVE-2025-62375 is a medium-severity security vulnerability in github.com/in-toto/go-witness (go), affecting versions < 0.9.1. It is fixed in 0.9.1.

Which versions of github.com/in-toto/go-witness are affected by CVE-2025-62375?

github.com/in-toto/go-witness (go) versions < 0.9.1 is affected.

Is there a fix for CVE-2025-62375?

Yes. CVE-2025-62375 is fixed in 0.9.1. Upgrade to this version or later.

Is CVE-2025-62375 exploitable, and should I be worried?

Whether CVE-2025-62375 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2025-62375 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2025-62375?

Upgrade github.com/in-toto/go-witness to 0.9.1 or later.

CVE-2025-62375 in github.com/in-toto/go-witness

Q: Which versions of github.com/in-toto/go-witness are affected by CVE-2025-62375?

github.com/in-toto/go-witness (go) versions < 0.9.1 is affected.

Q: Is there a fix for CVE-2025-62375?

Yes. CVE-2025-62375 is fixed in 0.9.1. Upgrade to this version or later.

Q: Is CVE-2025-62375 exploitable, and should I be worried?

Whether CVE-2025-62375 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2025-62375 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2025-62375?

Upgrade github.com/in-toto/go-witness to 0.9.1 or later.

Summary

go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents

Workarounds

The contents of the AWS attestation contain the identity document, signature, and public key that was used to verify the document. These attestations and their could be identity documents could be manually verified with the openssl command line as documented in the below reference from AWS.[^2]

However, the certificate containing the public key was hard-coded into the attestor.
https://github.com/in-toto/go-witness/blob/0c8bb30c143951d88b1d4b32f260c5f67d30137b/attestation/aws-iid/aws-iid.go#L46-L66

Since the original authoring of the attestor, AWS has moved to region specific public certificates. The currently valid certificates were issued around April of 2024, making the identification of attestations with forged content difficult without additional trusted data proving the AWS region in which the attestation was created.

Resources

[^1]: AWS Security Bulletin on IMDS Impersonation
[^2]: Verification of instance identity documents

Impact

This vulnerability only affects users of the AWS attestor.

Users of the AWS attestor could have unknowingly received a forged identity document. While this may seem unlikely, AWS recently issued a security bulletin about IMDS (Instance Metadata Service) impersonation.[^1]

There are multiple locations where the verification of the identity document will mistakenly report a successful verification.

If a signature is not present or is empty
https://github.com/in-toto/go-witness/blob/0c8bb30c143951d88b1d4b32f260c5f67d30137b/attestation/aws-iid/aws-iid.go#L161-L163
If the RSA verification of the document fails for any reason
https://github.com/in-toto/go-witness/blob/0c8bb30c143951d88b1d4b32f260c5f67d30137b/attestation/aws-iid/aws-iid.go#L192-L196

Affected versions

github.com/in-toto/go-witness (< 0.9.1)

Security releases

github.com/in-toto/go-witness → 0.9.1 (go)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

This vulnerability is addressed in go-witness 0.9.1 and witness 0.10.1.

Frequently Asked Questions

What is CVE-2025-62375? CVE-2025-62375 is a medium-severity security vulnerability in github.com/in-toto/go-witness (go), affecting versions < 0.9.1. It is fixed in 0.9.1.
Which versions of github.com/in-toto/go-witness are affected by CVE-2025-62375? github.com/in-toto/go-witness (go) versions < 0.9.1 is affected.
Is there a fix for CVE-2025-62375? Yes. CVE-2025-62375 is fixed in 0.9.1. Upgrade to this version or later.
Is CVE-2025-62375 exploitable, and should I be worried? Whether CVE-2025-62375 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2025-62375 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2025-62375? Upgrade github.com/in-toto/go-witness to 0.9.1 or later.