Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: LF-Edge, Zededa Component: Eve Clear all filters
TI-2023-23365 CVE-2023-43637 · GHSA-g7vp-j25f-h34p

Vault Key Partially Predetermined

Priority LOW 35

Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be "arfoobarfoobarfo".

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00142 Published 2023-09-21 Fixed in 7.10, 0.0.0-20220310190112-c0c966dc31e2 CWE-321
TI-2023-23361 CVE-2023-43633 · GHSA-4c4v-42hc-72p6

Debug Functions Unlockable Without Triggering Measured Boot

Priority LOW 39

On boot, the Pillar eve container checks for the existence and content of “/config/GlobalConfig/global.json”.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.0017 Published 2023-09-21 Fixed in 8.6.0, 9.5.0 +1 CWE-522
TI-2023-23362 CVE-2023-43634 · GHSA-wc42-fcjp-v8vq

Config Partition Not Protected by Measured Boot

Priority LOW 39

When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs are used.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00171 Published 2023-09-21 Fixed in 8.6.0, 9.5.0 +1 CWE-522