A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade keylime-tenantUpgrade keylime-selinuxUpgrade python3-keylimeUpgrade keylime-verifierUpgrade keylime-baseUpgrade keylimeUpgrade keylime-registrar | Sep 15, 2023 | Aug 25, 2023 |
| Centos_linux | — | Upgrade keylime-baseUpgrade keylime-verifierUpgrade keylime-tenantUpgrade keylime-registrarUpgrade keylime-selinuxUpgrade keylimeUpgrade python3-keylime | Sep 13, 2023 | Aug 25, 2023 |
| Oracle_linux | — | Upgrade keylimeUpgrade keylime-verifierUpgrade keylime-registrarUpgrade keylime-baseUpgrade keylime-tenantUpgrade python3-keylimeUpgrade keylime-selinux | Sep 13, 2023 | Aug 23, 2023 |
| Redhat_linux | — | Upgrade keylime-registrarUpgrade keylime-selinuxUpgrade keylimeUpgrade keylime-verifierUpgrade keylime-baseUpgrade python3-keylimeUpgrade keylime-tenant | Sep 13, 2023 | Aug 25, 2023 |
| Suse | — | Upgrade keylime-logrotateUpgrade python3-keylimeUpgrade keylime-tpm_cert_storeUpgrade keylime-agentUpgrade keylime-configUpgrade keylime-firewalldUpgrade keylime-verifierUpgrade keylime-registrar | Sep 6, 2023 | Aug 25, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub