p PatchFirst

CVE-2023-3674

CVE-2023-3674 · Keylime: attestation failure when the quote's signature does not validate

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

CVSS 2.3 · Low · EPSS 0.2% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • red hat enterprise linux 9

    Versions
    • ≥ 0:7.3.0-13.el9_3: Not affected (rpm)

    No fix published

  • keylime PyPI

    Versions
    • 6.3.1
    • 6.3.2
    • 6.4.0
    • 6.4.1
    • 6.4.2
    • 6.4.3
    • 6.5.0
    • 6.5.1
    • 6.5.2
    • 6.5.3
    • 6.6.0
    • 6.8.0
    • 7.0.0
    Affected ranges
    • ECOSYSTEM: < 7.2.5

    Update to 7.2.5

  • keylime PyPI

    Versions
    • 6.3.1
    • 6.3.2
    • 6.4.0
    • 6.4.1
    • 6.4.2
    • 6.4.3
    • 6.5.0
    • 6.5.1
    • 6.5.2
    • 6.5.3
    • 6.6.0
    • 6.8.0
    • 7.0.0
    • v7.3.0
    • v7.2.5
    • v6.5.0
    • v7.0.0
    • v6.7.0
    • v6.6.0
    • v6.5.3
    • v6.5.2
    • v5.8.2
    • v6.5.1
    • v6.4.3
    • v6.4.2
    • v6.4.1
    • v6.4.0
    • v6.3.2
    • v6.3.1
    • v6.3.0
    • v6.2.1
    • v6.2.0
    • 6.1.1
    • 6.1.0
    • 6.0.1
    • 6.0.0
    • v5.8.1
    • 5.8.1
    • 5.8.0
    • v4.0.1
    • 5.7.3
    • 5.7.2
    • 5.7.1
    • 5.7.0
    • 5.6.2
    • 5.6.1
    • 5.6.0
    • 5.5.0
    • 5.4.1
    • 5.4.0
    • 5.3.1
    • 5.3.0
    • 5.2.0
    • 5.1.0
    • 5.0.0
    • v4.0.0
    • v3.1.1
    • v3.1.0
    • v3.0.0
    • v2.3.4
    • v2.3.3
    • v2.3.2
    • v2.3.1
    • v2.3
    • v2.2
    • v2.1.1
    • v2.1
    • v2.0
    Affected ranges
    • GIT: < 95ce3d86bd2c53009108ffda2dcf553312d733db
    • ECOSYSTEM: < 7.2.5

    Update to 7.2.5

Original sources

Check your server →