VYPR
← All advisories
High severityNVD Advisory· Published Jul 24, 2023· Updated Nov 20, 2025

Keylime: registrar is subject to a dos against ssl connections

CVE-2023-38200

Description

A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Keylime registrar is vulnerable to remote denial of service via exhausting SSL connections due to blocking connection handling.

Vulnerability

A flaw in Keylime's registrar component causes it to accept SSL connections in a blocking manner, allowing an attacker to exhaust all available connections by initiating multiple handshakes without completing them [1][2]. This leads to a denial of service (DoS) condition.

Exploitation

An unauthenticated attacker can exploit this remotely by sending a high volume of SSL connection requests to the registrar, which will hold the connections open until resources are depleted. No special privileges or network position are required [1].

Impact

Successful exploitation prevents legitimate clients from registering with the Keylime system, disrupting remote attestation and trust bootstrapping functionalities [4].

Mitigation

Red Hat has acknowledged the issue (CVE-2023-38200) and it is tracked in Bugzilla [4]. As of the advisory, no patch is available; users should monitor the Keylime project [3] for updates and apply them when released.

References
  1. cve-details
  2. NVD - CVE-2023-38200
  3. GitHub - keylime/keylime: A CNCF Project to Bootstrap & Maintain Trust on the Edge / Cloud and IoT
  4. registrar is subject to a DoS against SSL connections

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
keylimePyPI
< 7.4.07.4.0

Affected products

13

Patches

1
c68d8f0b7ea5

Extend Registrar SSL socket to be non-blocking

https://github.com/keylime/keylimeflorianJul 11, 2023via ghsa
commit
1 file changed · +20 −1
  • keylime/registrar_common.py+20 −1 modified
    @@ -4,6 +4,7 @@
 import os
 import signal
 import socket
+import ssl
 import sys
 import threading
 from http.server import BaseHTTPRequestHandler, HTTPServer
@@ -77,6 +78,24 @@ def _validate_input(
 
 
 class ProtectedHandler(BaseHandler):
+    def handle(self) -> None:
+        """ Need to perform SSL handshake here, as do_handshake_on_connect=False for non-blocking SSL socket """
+        while True:
+            try:
+                self.request.do_handshake()
+                break
+            except ssl.SSLWantReadError:
+                select.select([sock], [], [])
+            except ssl.SSLWantWriteError:
+                select.select([], [sock], [])
+            except ssl.SSLError as e:
+                logger.error("SSL connection error: %s", e)
+                return
+            except Exception as e:
+                logger.error("General communication failure: %s", e)
+                return
+        BaseHTTPRequestHandler.handle(self)
+
     def do_HEAD(self) -> None:
         """HEAD not supported"""
         web_util.echo_json_response(self, 405, "HEAD not supported")
@@ -483,7 +502,7 @@ def start(host: str, tlsport: int, port: int) -> None:
     protected_server = RegistrarServer((host, tlsport), ProtectedHandler)
     context = web_util.init_mtls("registrar", logger=logger)
     if context is not None:
-        protected_server.socket = context.wrap_socket(protected_server.socket, server_side=True)
+        protected_server.socket = context.wrap_socket(protected_server.socket, server_side=True, do_handshake_on_connect=False)
     thread_protected_server = threading.Thread(target=protected_server.serve_forever)
 
     # Set up the unprotected registrar server

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.