GitHub Advisoryadvisory · PyPI
GHSA-g4wg-cfpf-9689 keylime fails to flag device as untrusted when signature does not validate
MEDIUM
Official page ↗
- Aliases
- CVE-2023-3674
- Ecosystem
- PyPI
- Packages
- keylime
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-1283
- Reviewed
- 2023-07-20
Affected packages
• PyPI keylime: < 7.2.5 → fixed in 7.2.5
Description
A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.
Related
Alias · CVE (1)
- CVE-2023-3674 A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's… vulnerability
Weakness · CWE (1)
- CWE-1283 Mutable Attestation or Measurement Reporting Data weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-3674 advisory
- https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db web
- https://access.redhat.com/errata/RHSA-2024:1139 web
- https://access.redhat.com/security/cve/CVE-2023-3674 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2222903 web
- https://github.com/keylime/keylime package
- https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2023-128.yaml web