A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibility that a rogue agent could create errors on the verifier that stopped attestation attempts for that host leaving it in an attested state but not verifying that anymore.
CVSS Details
- CVSS 3.1 Base Score: 5.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-keylimeUpgrade keylimeUpgrade keylime-selinuxUpgrade keylime-verifierUpgrade keylime-registrarUpgrade keylime-tenantUpgrade keylime-base | Nov 18, 2022 | Nov 15, 2022 |
| Centos_linux | — | Upgrade keylime-selinuxUpgrade python3-keylimeUpgrade keylime-tenantUpgrade keylimeUpgrade keylime-verifierUpgrade keylime-baseUpgrade keylime-registrar | Nov 16, 2022 | Nov 15, 2022 |
| Oracle_linux | — | Upgrade keylime-tenantUpgrade keylime-selinuxUpgrade python3-keylimeUpgrade keylime-registrarUpgrade keylime-verifierUpgrade keylime-baseUpgrade keylime | Nov 24, 2022 | Oct 27, 2022 |
| Redhat_linux | — | Upgrade keylimeUpgrade python3-keylimeUpgrade keylime-tenantUpgrade keylime-verifierUpgrade keylime-selinuxUpgrade keylime-registrarUpgrade keylime-base | Nov 16, 2022 | Nov 15, 2022 |
| Rocky_linux | — | Upgrade keylime-baseUpgrade python3-keylimeUpgrade keylimeUpgrade keylime-tenantUpgrade keylime-registrarUpgrade keylime-verifier | Mar 12, 2024 | Nov 22, 2022 |
| Suse | — | Upgrade keylime-registrarUpgrade keylime-verifierUpgrade keylime-configUpgrade keylime-logrotateUpgrade keylime-tpm_cert_storeUpgrade keylime-agentUpgrade keylime-firewalldUpgrade python3-keylime | Nov 24, 2022 | Nov 22, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub