Keylime: keylime registrar dos due to incompatible database entry handling
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar from reading database entries created by previous versions, for example, 7.11.0. Specifically, older versions store agent registration data as bytes, whereas the updated registrar expects str. This issue leads to an exception when processing agent registration requests, causing the agent to fail.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | keylime | 7.12.0 | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| — | keylime (PyPI) | 7.12.0 to before 7.12.1 | 7.12.1 | Patch available | GHSA-9jxq-5x44-gx23 |
- keylime Vendor— Affected 7.12.0 Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- keylime (PyPI) Vendor— Affected 7.12.0 to before 7.12.1 Fixed in 7.12.1 Patch available GHSA-9jxq-5x44-gx23
Remediation
- Fix · GHSA-9jxq-5x44-gx23 keylime (PyPI) Fixed in 7.12.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 2 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2025-1057
- 2026-10-03 Alias added: GHSA-9jxq-5x44-gx23
References
Advisory 2
Other 9
- https://access.redhat.com/security/cve/CVE-2025-1057
- RHBZ#2343894
- https://github.com/ansasaki/keylime/tree/base64_bytes
- https://github.com/keylime/rust-keylime
- https://github.com/keylime/keylime/security/advisories/GHSA-9jxq-5x44-gx23
- https://github.com/keylime/keylime/commit/e08b10d86c3717006774e787542c190e2ba24fc7
- https://github.com/keylime/keylime
- https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2026-1488.yaml
- https://pypi.org/project/keylime
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-1057 · CVE Program
- CVE-2025-1057 · NVD
- FIRST EPSS
- GHSA-9jxq-5x44-gx23 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-1057 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences