A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibility that a rogue agent could create errors on the verifier that stopped attestation attempts for that host leaving it in an attested state but not verifying that anymore.
CVSS Details
- CVSS 3.1 Base Score: 5.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-keylimeUpgrade keylime-verifierUpgrade keylimeUpgrade keylime-registrarUpgrade keylime-baseUpgrade keylime-tenantUpgrade keylime-selinux | Nov 18, 2022 | Nov 15, 2022 |
| Centos_linux | — | Upgrade keylime-baseUpgrade keylime-registrarUpgrade keylimeUpgrade keylime-verifierUpgrade keylime-tenantUpgrade keylime-selinuxUpgrade python3-keylime | Nov 16, 2022 | Nov 15, 2022 |
| Oracle_linux | — | Upgrade keylime-tenantUpgrade keylime-selinuxUpgrade python3-keylimeUpgrade keylime-registrarUpgrade keylime-baseUpgrade keylimeUpgrade keylime-verifier | Nov 24, 2022 | Oct 27, 2022 |
| Redhat_linux | — | Upgrade keylimeUpgrade python3-keylimeUpgrade keylime-verifierUpgrade keylime-registrarUpgrade keylime-baseUpgrade keylime-selinuxUpgrade keylime-tenant | Nov 16, 2022 | Nov 15, 2022 |
| Rocky_linux | — | Upgrade keylimeUpgrade keylime-verifierUpgrade keylime-registrarUpgrade keylime-tenantUpgrade python3-keylimeUpgrade keylime-base | Mar 12, 2024 | Nov 22, 2022 |
| Suse | — | Upgrade keylime-tpm_cert_storeUpgrade keylime-configUpgrade keylime-logrotateUpgrade keylime-verifierUpgrade keylime-registrarUpgrade keylime-agentUpgrade python3-keylimeUpgrade keylime-firewalld | Nov 24, 2022 | Nov 22, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub