Lucene search

GoogleOSV:CVE-2022-23949

HistorySep 21, 2022 - 7:15 p.m.

CVE-2022-23949

2022-09-2119:15:10

Google

osv.dev

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.2%

JSON

In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar.

CPENameOperatorVersion
keylimeeq5.4.1
keylimeeq4.0.0
keylimeeq2.3.2
keylimeeq2.1
keylimeeq2.2
keylimeeq3.0.0
keylimeeq5.3.0
keylimeeq2.1.1
keylimeeq5.8.0
keylimeeq5.1.0

Name	Operator	Version
keylime	eq	5.4.1
keylime	eq	4.0.0
keylime	eq	2.3.2
keylime	eq	2.1
keylime	eq	2.2
keylime	eq	3.0.0
keylime	eq	5.3.0
keylime	eq	2.1.1
keylime	eq	5.8.0
keylime	eq	5.1.0

Rows per page:

1-10 of 371

References

github.com/keylime/keylime/commit/387e320dc22c89f4f47c68cb37eb9eec2137f34b

github.com/keylime/keylime/commit/65c2b737129b5837f4a03660aeb1191ced275a57

github.com/keylime/keylime/commit/e429e95329fc60608713ddfb82f4a92ee3b3d2d9

github.com/keylime/keylime/security/advisories/GHSA-87gh-qc28-j9mm

seclists.org/oss-sec/2022/q1/101

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.2%

JSON

Related for OSV:CVE-2022-23949