GitHub Advisoryadvisory · Go

GHSA-4jvr-vj2c-8q37 EVE Seals Vault Key With SHA1 PCRs

MEDIUM Published 2026-02-04 Modified 2026-02-04 Official page ↗
Aliases
CVE-2023-43635
Ecosystem
Go
Packages
github.com/lf-edge/eve
Severity
Moderate
CVSS vector
CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-327, CWE-328, CWE-522
Reviewed
2026-02-04

Affected packages

• Go github.com/lf-edge/eve: < 0.0.0-20230519072751-977f42b07fa9 → fixed in 0.0.0-20230519072751-977f42b07fa9

Description

Impact The vault key is sealed using SHA1 PCRs instead of SHA256 PCRs Thus an attacker with physical access to an EVE-OS device can try to brute force creating a kernel or rootfs image which produces the same SHA1 PCR but with malicious content. Patches Fixed in 9.4.3-lts and 10.1.0 Workarounds None

Related

Alias · CVE (1)

  • CVE-2023-43635 Vault Key Sealed With SHA1 PCRs The measured boot solution implemented in EVE OS leans on a PCR locking mechanism. vulnerability

Weakness · CWE (3)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness
  • CWE-328 Use of Weak Hash weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References