A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade keylime-selinuxUpgrade keylime-verifierUpgrade keylime-tenantUpgrade python3-keylimeUpgrade keylime-baseUpgrade keylimeUpgrade keylime-registrar | Sep 15, 2023 | Aug 25, 2023 |
| Centos_linux | — | Upgrade keylime-selinuxUpgrade keylime-tenantUpgrade keylimeUpgrade python3-keylimeUpgrade keylime-registrarUpgrade keylime-verifierUpgrade keylime-base | Sep 13, 2023 | Aug 25, 2023 |
| Oracle_linux | — | Upgrade keylime-tenantUpgrade python3-keylimeUpgrade keylime-baseUpgrade keylime-registrarUpgrade keylime-verifierUpgrade keylime-selinuxUpgrade keylime | Sep 13, 2023 | Aug 23, 2023 |
| Redhat_linux | — | Upgrade python3-keylimeUpgrade keylime-tenantUpgrade keylime-baseUpgrade keylime-verifierUpgrade keylimeUpgrade keylime-registrarUpgrade keylime-selinux | Sep 13, 2023 | Aug 25, 2023 |
| Suse | — | Upgrade keylime-verifierUpgrade keylime-firewalldUpgrade keylime-agentUpgrade keylime-registrarUpgrade keylime-configUpgrade keylime-tpm_cert_storeUpgrade python3-keylimeUpgrade keylime-logrotate | Sep 6, 2023 | Aug 25, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub