Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

13 records

Vendor: Keylime Clear all filters
TI-2023-19614 CVE-2023-38201 · GHSA-f4r5-q63f-gcww

Keylime: challenge-response protocol bypass during agent registration

Priority LOW 29

A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.0049 Published 2023-08-25 Fixed in 6.5.2-6.el9_2, 7.5.0 CWE-639
TI-2023-03431 CVE-2023-3674 · GHSA-g4wg-cfpf-9689

Keylime: attestation failure when the quote's signature does not validate

Priority LOW 13

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason.

CVSS 3.1LOW 2.8 Local Low privileges User interaction EPSS 0.00212 Published 2023-07-19 Fixed in 7.3.0-13.el9_3, 7.2.5 CWE-1283
TI-2022-03230 CVE-2022-3500 · GHSA-hff2-x2j9-gxgv

A vulnerability was found in keylime.

Priority LOW 23

A vulnerability was found in keylime.

CVSS 3.1MEDIUM 5.1 Local No auth No interaction EPSS 0.00264 Published 2022-11-22 Fixed in 6.5.1 CWE-248
TI-2022-07924 CVE-2022-23952

Information disclosure in keylime

Priority LOW 36

In Keylime before 6.3.0, current keylime installer installs the keylime.conf file, which can contain sensitive data, as world-readable.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01428 Published 2022-09-21 No fix listed CWE-200
TI-2022-07923 CVE-2022-23951

Uncontrolled resource consumption in keylime

Priority MEDIUM 58

In Keylime before 6.3.0, quote responses from the agent can contain possibly untrusted ZIP data which can lead to zip bombs.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00433 Published 2022-09-21 No fix listed CWE-400
TI-2022-07922 CVE-2022-23950

Exposure of resource to wrong sphere in keylime

Priority HIGH 72

In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operations.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0167 Published 2022-09-21 No fix listed CWE-379
TI-2022-07921 CVE-2022-23949

Authentication bypass by spoofing in keylime

Priority HIGH 72

In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01384 Published 2022-09-21 No fix listed CWE-290
TI-2021-19303 CVE-2021-43310

Authentication bypass by spoofing in keylime

Priority HIGH 82

A vulnerability in Keylime before 6.3.0 allows an attacker to craft a request to the agent that resets the U and V keys as if the agent were being re-added to a verifier.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02209 Published 2022-09-21 No fix listed CWE-290
TI-2022-07920 CVE-2022-23948

Information disclosure in keylime

Priority LOW 36

A flaw was found in Keylime before 6.3.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0146 Published 2022-09-21 No fix listed CWE-200
TI-2022-00950 CVE-2022-1053 · GHSA-jf66-3q76-h5p5

Improper input validation in keylime

Priority MEDIUM 42

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01479 Published 2022-05-06 Fixed in 6.4.0 CWE-20