A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade keylime-registrarUpgrade keylime-selinuxUpgrade keylimeUpgrade keylime-tenantUpgrade python3-keylimeUpgrade keylime-verifierUpgrade keylime-base | Dec 18, 2025 | Dec 15, 2025 |
| Oracle_linux | — | Upgrade python3-keylimeUpgrade keylime-toolsUpgrade keylimeUpgrade keylime-tenantUpgrade keylime-registrarUpgrade keylime-verifierUpgrade keylime-selinuxUpgrade keylime-base | Dec 22, 2025 | Nov 24, 2025 |
| Redhat_linux | — | Upgrade keylimeUpgrade keylime-toolsUpgrade keylime-registrarUpgrade keylime-verifierUpgrade keylime-tenantUpgrade python3-keylimeUpgrade keylime-selinuxUpgrade keylime-base | Dec 17, 2025 | Nov 24, 2025 |
| Rocky_linux | — | Upgrade keylime-registrarUpgrade keylime-toolsUpgrade python3-keylimeUpgrade keylime-verifierUpgrade keylimeUpgrade keylime-baseUpgrade keylime-tenant | Feb 5, 2026 | Dec 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub