Privasys rustls, a fork of the rustls TLS library, implemented RA‑TLS challenge certificates that, before version 0.8.1, attached the attestation report data only to the certificate’s public key and client nonce. The report data was not tied to the specific TLS session in which the certificate was used. Consequently, an attacker who could obtain a private key for the enclave’s TLS connection could capture a legitimate quote and replay it on a different connection. The relying party would then accept the attacker‑terminated session as if it were the authentic, attested enclave, effectively allowing the attacker to impersonate the enclave and potentially access or manipulate protected data. This flaw is classified as CWE‑346, an information disclosure of the attestation binding.

Any system that uses the Privasys rustls library in a version earlier than privasys‑v0.8.1 is affected. The vendor is Privasys, product rustls, and all releases prior to v0.8.1 contain the vulnerability; the fix is present in v0.8.1 and later.

The CVSS score of 9.1 indicates critical severity. The EPSS score is not available, but the flaw is not listed in CISA KEV, suggesting that large‑scale exploitation is not yet documented. The attack requires possession of the enclave TLS private key, which could be obtained through a compromise of the enclave environment or a supply‑chain attack. Once the key is in hand, the attacker can forge a TLS session that presents valid attestation evidence, leading to malicious actions such as data exfiltration, privilege escalation of the relying party, or other trust‑based attacks. The risk remains high until the library is updated and TLS sessions are properly bound to their attestation evidence.