A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade keylime-registrarUpgrade keylime-baseUpgrade keylimeUpgrade keylime-verifierUpgrade keylime-tenantUpgrade python3-keylimeUpgrade keylime-selinux | Sep 15, 2023 | Aug 25, 2023 |
| Centos_linux | — | Upgrade keylime-verifierUpgrade keylime-baseUpgrade keylimeUpgrade keylime-tenantUpgrade keylime-registrarUpgrade python3-keylimeUpgrade keylime-selinux | Sep 13, 2023 | Aug 25, 2023 |
| Oracle_linux | — | Upgrade keylime-verifierUpgrade keylime-tenantUpgrade keylime-registrarUpgrade keylime-selinuxUpgrade python3-keylimeUpgrade keylime-baseUpgrade keylime | Sep 13, 2023 | Aug 23, 2023 |
| Redhat_linux | — | Upgrade python3-keylimeUpgrade keylime-tenantUpgrade keylime-registrarUpgrade keylime-baseUpgrade keylimeUpgrade keylime-verifierUpgrade keylime-selinux | Sep 13, 2023 | Aug 25, 2023 |
| Suse | — | Upgrade keylime-tpm_cert_storeUpgrade keylime-logrotateUpgrade python3-keylimeUpgrade keylime-configUpgrade keylime-verifierUpgrade keylime-agentUpgrade keylime-firewalldUpgrade keylime-registrar | Sep 6, 2023 | Aug 25, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub