CVEvulnerability

CVE-2023-38201

6.5 MEDIUM Published 2023-08-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-08-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-639

Description

A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.

Affected configurations

• keylime keylime (< 7.5.0) • redhat enterprise linux 9.0 • redhat enterprise linux eus 9.2 • redhat enterprise linux for ibm z systems 9.0 s390x • redhat enterprise linux for ibm z systems eus 9.2 s390x • redhat enterprise linux for power little endian 9.0 ppc64le • redhat enterprise linux for power little endian eus 9.2 ppc64le • redhat enterprise linux server aus 9.2 • fedoraproject fedora 38

Related

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References