A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibility that a rogue agent could create errors on the verifier that stopped attestation attempts for that host leaving it in an attested state but not verifying that anymore.
CVSS Details
- CVSS 3.1 Base Score: 5.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade keylime-baseUpgrade keylimeUpgrade keylime-registrarUpgrade keylime-verifierUpgrade keylime-selinuxUpgrade keylime-tenantUpgrade python3-keylime | Nov 18, 2022 | Nov 15, 2022 |
| Centos_linux | — | Upgrade keylime-baseUpgrade keylimeUpgrade keylime-verifierUpgrade keylime-registrarUpgrade python3-keylimeUpgrade keylime-tenantUpgrade keylime-selinux | Nov 16, 2022 | Nov 15, 2022 |
| Oracle_linux | — | Upgrade keylime-registrarUpgrade keylime-verifierUpgrade keylime-baseUpgrade keylimeUpgrade python3-keylimeUpgrade keylime-tenantUpgrade keylime-selinux | Nov 24, 2022 | Oct 27, 2022 |
| Redhat_linux | — | Upgrade keylimeUpgrade python3-keylimeUpgrade keylime-selinuxUpgrade keylime-verifierUpgrade keylime-tenantUpgrade keylime-registrarUpgrade keylime-base | Nov 16, 2022 | Nov 15, 2022 |
| Rocky_linux | — | Upgrade keylime-registrarUpgrade keylime-tenantUpgrade keylimeUpgrade keylime-verifierUpgrade keylime-baseUpgrade python3-keylime | Mar 12, 2024 | Nov 22, 2022 |
| Suse | — | Upgrade keylime-firewalldUpgrade python3-keylimeUpgrade keylime-agentUpgrade keylime-tpm_cert_storeUpgrade keylime-verifierUpgrade keylime-logrotateUpgrade keylime-configUpgrade keylime-registrar | Nov 24, 2022 | Nov 22, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub