A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade keylime-baseUpgrade keylime-verifierUpgrade keylime-tenantUpgrade keylime-selinuxUpgrade keylime-registrarUpgrade keylimeUpgrade python3-keylime | Mar 8, 2024 | Jul 19, 2023 |
| Oracle_linux | — | Upgrade keylime-baseUpgrade keylime-tenantUpgrade keylime-registrarUpgrade keylimeUpgrade keylime-selinuxUpgrade python3-keylimeUpgrade keylime-verifier | Mar 6, 2024 | Jul 12, 2023 |
| Redhat_linux | — | Upgrade keylimeUpgrade keylime-registrarUpgrade keylime-baseUpgrade python3-keylimeUpgrade keylime-selinuxUpgrade keylime-tenantUpgrade keylime-verifier | Mar 6, 2024 | Jul 19, 2023 |
| Rocky_linux | — | Upgrade keylimeUpgrade keylime-tenantUpgrade keylime-registrarUpgrade python3-keylimeUpgrade keylime-verifierUpgrade keylime-base | May 13, 2024 | Jul 19, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub