A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade keylime-selinuxUpgrade keylime-verifierUpgrade keylime-tenantUpgrade python3-keylimeUpgrade keylime-baseUpgrade keylimeUpgrade keylime-registrar | Sep 15, 2023 | Aug 25, 2023 |
| Centos_linux | — | Upgrade keylime-tenantUpgrade python3-keylimeUpgrade keylime-registrarUpgrade keylime-selinuxUpgrade keylimeUpgrade keylime-verifierUpgrade keylime-base | Sep 13, 2023 | Aug 25, 2023 |
| Oracle_linux | — | Upgrade keylimeUpgrade keylime-tenantUpgrade keylime-baseUpgrade keylime-verifierUpgrade keylime-registrarUpgrade keylime-selinuxUpgrade python3-keylime | Sep 13, 2023 | Aug 23, 2023 |
| Redhat_linux | — | Upgrade keylime-verifierUpgrade keylime-selinuxUpgrade keylime-baseUpgrade keylimeUpgrade keylime-registrarUpgrade keylime-tenantUpgrade python3-keylime | Sep 13, 2023 | Aug 25, 2023 |
| Suse | — | Upgrade keylime-logrotateUpgrade python3-keylimeUpgrade keylime-tpm_cert_storeUpgrade keylime-registrarUpgrade keylime-configUpgrade keylime-verifierUpgrade keylime-firewalldUpgrade keylime-agent | Sep 6, 2023 | Aug 25, 2023 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub