A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibility that a rogue agent could create errors on the verifier that stopped attestation attempts for that host leaving it in an attested state but not verifying that anymore.
CVSS Details
- CVSS 3.1 Base Score: 5.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade keylimeUpgrade keylime-tenantUpgrade keylime-baseUpgrade keylime-registrarUpgrade keylime-selinuxUpgrade keylime-verifierUpgrade python3-keylime | Nov 18, 2022 | Nov 15, 2022 |
| Centos_linux | — | Upgrade keylime-verifierUpgrade keylime-baseUpgrade keylimeUpgrade keylime-registrarUpgrade keylime-tenantUpgrade keylime-selinuxUpgrade python3-keylime | Nov 16, 2022 | Nov 15, 2022 |
| Oracle_linux | — | Upgrade keylimeUpgrade keylime-verifierUpgrade keylime-baseUpgrade keylime-registrarUpgrade keylime-selinuxUpgrade python3-keylimeUpgrade keylime-tenant | Nov 24, 2022 | Oct 27, 2022 |
| Redhat_linux | — | Upgrade keylime-selinuxUpgrade keylime-baseUpgrade keylime-registrarUpgrade keylime-tenantUpgrade keylime-verifierUpgrade python3-keylimeUpgrade keylime | Nov 16, 2022 | Nov 15, 2022 |
| Rocky_linux | — | Upgrade python3-keylimeUpgrade keylime-baseUpgrade keylime-verifierUpgrade keylime-tenantUpgrade keylimeUpgrade keylime-registrar | Mar 12, 2024 | Nov 22, 2022 |
| Suse | — | Upgrade keylime-agentUpgrade keylime-firewalldUpgrade python3-keylimeUpgrade keylime-logrotateUpgrade keylime-configUpgrade keylime-verifierUpgrade keylime-registrarUpgrade keylime-tpm_cert_store | Nov 24, 2022 | Nov 22, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub