RHEL 9 : keylime (RHSA-2023:5080)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5080 advisory. Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution. Security Fixes: keylime: registra...

Authorization Bypass

Keylime is vulnerable to an attack which allows an attacker to Bypass the Challenge-Response Protocol during agent registration. The vulnerability occurs due to the registrar disclosing the correct "authtag" in the error message. This could allow an attacker to simply record the correct expected...

Keylime registrar and (untrusted) Agent can be bypassed by an attacker

Impact A security issue was found in the Keylime registrar code which allows an attacker to effectively bypass the challenge-response protocol used to verify that an agent has indeed access to an AIK which in indeed related to the EK. When an agent starts up, it will contact a registrar and provi...

GHSA-F4R5-Q63F-GCWW Keylime registrar and (untrusted) Agent can be bypassed by an attacker

Impact A security issue was found in the Keylime registrar code which allows an attacker to effectively bypass the challenge-response protocol used to verify that an agent has indeed access to an AIK which in indeed related to the EK. When an agent starts up, it will contact a registrar and provi...

SUSE CVE-2023-38201

A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimat...

SUSE SLED15: keylime-agent / keylime-config / keylime-firewalld / etc (SUSE-SU-2023:3525-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3525-1 advisory. - CVE-2023-38201: Fixed a bug to avoid leaks of the authorization tag. bsc1213314 Tenable has extracted t...

Google strengthens its Workplace suite protection

Google has announced the strengthening of safeguard measures for its Workspace customers. You may well be using Workspace without realising it. If youre using a Google product such as Gmail, Calendar, Drive, or Google Docs Editors Suite among other apps, then congratulations: you are fully inside...

CVE-2023-38201

A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimat...

CVE-2023-38201

A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimat...

PYSEC-2023-160

A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimat...

Design/Logic Flaw

A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimat...

PYSEC-2023-160

A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimat...

CVE-2023-38201 Keylime: challenge-response protocol bypass during agent registration

A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimat...

CVE-2023-38201 Keylime: challenge-response protocol bypass during agent registration

A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimat...

CVE-2023-38201

CVE-2023-38201 is a vulnerability in Keylime's registrar where the challenge-response during agent registration can be bypassed, enabling impersonation of an agent and potentially compromising the integrity of the registrar database. Reported across multiple advisories (e.g., ALSA-2023:5080, ELSA...

CVE-2023-38201

A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimat...

CVE-2023-38201: Authorization Bypass Through User-Controlled Key

A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimat...

PT-2023-26334 · Keylime +3 · Keylime +3

Name of the Vulnerable Software and Affected Versions: Keylime versions prior to 7.5.0 Description: A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide t...

Malicious code in devops-challenge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ae82cf2333c3027eb9266e05dfa4697724ae1623e3b662c2b129d5f716f55aa4 The OpenSSF Package Analysis project identified 'devops-challenge' @ 99.99.990 npm as malicious. It is considered malicious because: - The packa...

White House Announces AI Cybersecurity Challenge

At Black Hat last week, the White House announced an AI Cyber Challenge. Gizmodo reports: The new AI cyber challenge which is being abbreviated "AIxCC" will have a number of different phases. Interested would-be competitors can now submit their proposals to the Small Business Innovation Research...