A vulnerability was found in keylime.
Priority LOW 23CWE-248Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-248.
Summary
A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibility that a rogue agent could create errors on the verifier that stopped attestation attempts for that host leaving it in an attested state but not verifying that anymore.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00264 18th percentileScored 2026-11-07
Fix Fixed keylime (PyPI): 6.5.1Red Hat: 1 advisory
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | keylime | keylime 6.5.2 | — | No fix listed | CNA |
| — | keylime (PyPI) | before 6.5.1 | 6.5.1 | Patch available | GHSA-hff2-x2j9-gxgv |
- keylime Vendor— Affected keylime 6.5.2 Fixed in — No fix listed CNA
- keylime (PyPI) Vendor— Affected before 6.5.1 Fixed in 6.5.1 Patch available GHSA-hff2-x2j9-gxgv
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:keylime:keylime:*:*:*:*:*:*:*:* | before 6.5.1 | Vulnerable | Keylime |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
- cpe:2.3:a:keylime:keylime:*:*:*:*:*:*:*:* Versions before 6.5.1 Vulnerable ·Keylime
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-hff2-x2j9-gxgv keylime (PyPI) Fixed in 6.5.1 Advisory →
Red Hat 1 advisory
- RHSA-2022:8444 Released 2022-11-15 · Red Hat rating Moderatekeylime security update
- Red Hat Enterprise Linux AppStream (v. 9) keylime-6.5.1-1.el9_1, keylime-base-6.5.1-1.el9_1, keylime-registrar-6.5.1-1.el9_1 +4
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:8444 |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-3500
- 2026-10-03 Alias added: GHSA-hff2-x2j9-gxgv
References
Advisory 5
Other 10
- https://github.com/keylime/keylime/security/advisories/GHSA-hff2-x2j9-gxgv
- https://github.com/keylime/keylime/commit/f969d397f92962b553f8c5bcbbeeb3bbdeca9456
- https://github.com/keylime/keylime
- https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2022-42995.yaml
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PUTHMDVFNGGVPCNPOGULMJAAFEP7MEXP
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QX4XVCAUFGJ2I2NCTOKONTJGRJB2NBBT
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQH5CJRX65QYMQN5WGUKKKE3IRJBWG5Z
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PUTHMDVFNGGVPCNPOGULMJAAFEP7MEXP
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QX4XVCAUFGJ2I2NCTOKONTJGRJB2NBBT
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZQH5CJRX65QYMQN5WGUKKKE3IRJBWG5Z
Sources
- CVE-2022-3500 · CVE Program
- CVE-2022-3500 · NVD
- FIRST EPSS
- GHSA-hff2-x2j9-gxgv · GitHub Advisory Database · CC BY 4.0
- CVE-2022-3500 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences