CVEvulnerability

CVE-2021-3406

9.8 CRITICAL Published 2021-02-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-02-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-295, CWE-347

Description

A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations.

Affected configurations

• keylime keylime (<= 5.8.1) • fedoraproject fedora 34

Related

Weakness · CWE (2)

  • CWE-295 Improper Certificate Validation weakness
  • CWE-347 Improper Verification of Cryptographic Signature weakness

References