A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibility that a rogue agent could create errors on the verifier that stopped attestation attempts for that host leaving it in an attested state but not verifying that anymore.
CVSS Details
- CVSS 3.1 Base Score: 5.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade keylime-verifierUpgrade keylimeUpgrade keylime-baseUpgrade keylime-tenantUpgrade python3-keylimeUpgrade keylime-registrarUpgrade keylime-selinux | Nov 18, 2022 | Nov 15, 2022 |
| Centos_linux | — | Upgrade keylime-registrarUpgrade keylime-verifierUpgrade keylime-baseUpgrade keylimeUpgrade keylime-selinuxUpgrade keylime-tenantUpgrade python3-keylime | Nov 16, 2022 | Nov 15, 2022 |
| Oracle_linux | — | Upgrade keylime-selinuxUpgrade keylime-tenantUpgrade python3-keylimeUpgrade keylimeUpgrade keylime-baseUpgrade keylime-registrarUpgrade keylime-verifier | Nov 24, 2022 | Oct 27, 2022 |
| Redhat_linux | — | Upgrade keylimeUpgrade python3-keylimeUpgrade keylime-registrarUpgrade keylime-baseUpgrade keylime-verifierUpgrade keylime-selinuxUpgrade keylime-tenant | Nov 16, 2022 | Nov 15, 2022 |
| Rocky_linux | — | Upgrade keylime-verifierUpgrade keylime-registrarUpgrade keylimeUpgrade keylime-tenantUpgrade keylime-baseUpgrade python3-keylime | Mar 12, 2024 | Nov 22, 2022 |
| Suse | — | Upgrade keylime-firewalldUpgrade python3-keylimeUpgrade keylime-agentUpgrade keylime-tpm_cert_storeUpgrade keylime-verifierUpgrade keylime-configUpgrade keylime-registrarUpgrade keylime-logrotate | Nov 24, 2022 | Nov 22, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub