Summary
Vulnerable OpenSSL included in sgx-dcap-quote-verify-python
sgx-dcap-quote-verify-python includes a statically linked copy of OpenSSL. The version of OpenSSL included in sgx-dcap-quote-verify-python 0.0.1..0.0.2 is vulnerable to a security issue. More details about the OpenSSL vulnerabilities themselves can be found at https://www.openssl.org/news/secadv/20230207.txt.
Analysis
The binding includes OpenSSL version 1.1.1s which is vulnerable to the vulnerabilities disclosed in OpenSSL Security Advisory from the 7th February 2023.
The binding does not directly use OpenSSL. The binding calls the SGX Quote Verification Library which uses OpenSSL.
Explanation
The SGX Quote Verification Library uses OpenSSL as a dependency to perform its cryptographic operations and certificate verification.
The OpenSSL security advisory mentions multiple vulnerabilities but I believe the most concerning would be CVE-2023-0286 “X.400 address type confusion in X.509 GeneralName”. Its severity is rated high and the advisory states that “this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.”
Relying on CRLs obtained from an untrusted party is exactly what can happen when verifying a quote. For instance, the vulnerability could be triggered through the "sgx_qv_verify_quote" function which can take untrusted quote collateral as input. The quote collateral contains a CRL and certificate chains. The Quote Verification Library uses OpenSSL to verify the validity of those in order to establish the authenticity of the quote. Thus the vulnerability could be exploited with corrupted/forged collateral and quote.
Impact
According to the advisory the "vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service". Transitively I expect the same to be true for the Quote Verification Library.
The denial of service impact is not much of a concern I believe since processing forged collateral would most likely stop the software from proceeding normally anyway (forged collateral should be rejected). The part regarding the ability to read memory contents, could result in information disclosure which is a real concern. The quote verification happens on the relying party end, which might use it to check enclave authenticity before providing sensitive data, this vulnerability could therefore result in the leakage of sensitive data.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is GHSA-344M-QCJQ-XGRF? GHSA-344M-QCJQ-XGRF is a high-severity security vulnerability in sgx-dcap-quote-verify-python (pip), affecting versions < 0.0.3. It is fixed in 0.0.3.
- Which versions of sgx-dcap-quote-verify-python are affected by GHSA-344M-QCJQ-XGRF? sgx-dcap-quote-verify-python (pip) versions < 0.0.3 is affected.
- Is there a fix for GHSA-344M-QCJQ-XGRF? Yes. GHSA-344M-QCJQ-XGRF is fixed in 0.0.3. Upgrade to this version or later.
- Is GHSA-344M-QCJQ-XGRF exploitable, and should I be worried? Whether GHSA-344M-QCJQ-XGRF is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-344M-QCJQ-XGRF is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-344M-QCJQ-XGRF? Upgrade
sgx-dcap-quote-verify-pythonto 0.0.3 or later.