rpm package
suse/keylime&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4
pkg:rpm/suse/keylime&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-38201 | — | < 6.3.2-150400.4.20.1 | 6.3.2-150400.4.20.1 | Aug 25, 2023 | A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier li | ||
| CVE-2023-38200 | — | < 6.3.2-150400.4.17.1 | 6.3.2-150400.4.17.1 | Jul 24, 2023 | A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections. | ||
| CVE-2022-3500 | — | < 6.3.2-150400.4.14.1 | 6.3.2-150400.4.14.1 | Nov 22, 2022 | A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibility that a rogue agent could create errors on the verifier that stopped attestation attempts for that host leaving it in an | ||
| CVE-2022-31250 | — | < 6.3.2-150400.4.11.1 | 6.3.2-150400.4.11.1 | Jul 20, 2022 | A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This issue affects: openSUSE Tumbleweed keylime versions prior to 6.4.2-1.1. | ||
| CVE-2022-1053 | — | < 6.3.2-150400.4.11.1 | 6.3.2-150400.4.11.1 | May 6, 2022 | Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and giv |
- CVE-2023-38201Aug 25, 2023affected < 6.3.2-150400.4.20.1fixed 6.3.2-150400.4.20.1
A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier li
- CVE-2023-38200Jul 24, 2023affected < 6.3.2-150400.4.17.1fixed 6.3.2-150400.4.17.1
A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.
- CVE-2022-3500Nov 22, 2022affected < 6.3.2-150400.4.14.1fixed 6.3.2-150400.4.14.1
A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibility that a rogue agent could create errors on the verifier that stopped attestation attempts for that host leaving it in an
- CVE-2022-31250Jul 20, 2022affected < 6.3.2-150400.4.11.1fixed 6.3.2-150400.4.11.1
A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This issue affects: openSUSE Tumbleweed keylime versions prior to 6.4.2-1.1.
- CVE-2022-1053May 6, 2022affected < 6.3.2-150400.4.11.1fixed 6.3.2-150400.4.11.1
Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and giv