CVE-2022-23950

In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operations...

CVE-2022-23949

In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar...

CVE-2022-23949

In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar...

CVE-2022-23949

CVE-2022-23949 affects Keylime

CVE-2022-23949

In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar...

CVE-2021-43310

Keylime CVE-2021-43310 affects Keylime before 6.3.0. The vulnerability lets an attacker craft a request to the agent to reset the U and V keys as if re-adding the agent to a verifier, potentially enabling remote code execution. Affected versions are prior to 6.3.0; remediation is to upgrade to 6....

CVE-2021-43310

A vulnerability in Keylime before 6.3.0 allows an attacker to craft a request to the agent that resets the U and V keys as if the agent were being re-added to a verifier. This could lead to a remote code execution...

CVE-2021-43310

A vulnerability in Keylime before 6.3.0 allows an attacker to craft a request to the agent that resets the U and V keys as if the agent were being re-added to a verifier. This could lead to a remote code execution...

CVE-2022-23948

A flaw was found in Keylime before 6.3.0. The logic in the Keylime agent for checking for a secure mount can be fooled by previously created unprivileged mounts allowing secrets to be leaked to other processes on the host...

CVE-2022-23948

A flaw was found in Keylime before 6.3.0. The logic in the Keylime agent for checking for a secure mount can be fooled by previously created unprivileged mounts allowing secrets to be leaked to other processes on the host...

CVE-2022-23948

CVE-2022-23948 affects Keylime prior to 6.3.0. The flaw is in the Keylime agent’s logic for verifying a secure mount, which can be fooled by previously created unprivileged mounts, allowing secrets to be leaked to other processes on the host. Affected product: Keylime (agent component) prior to 6...

CVE-2022-23948

A flaw was found in Keylime before 6.3.0. The logic in the Keylime agent for checking for a secure mount can be fooled by previously created unprivileged mounts allowing secrets to be leaked to other processes on the host...

PT-2022-16359 · Keylime · Keylime

Name of the Vulnerable Software and Affected Versions: Keylime versions prior to 6.3.0 Description: The issue allows unsanitized UUIDs to be passed by a rogue agent, leading to log spoofing on the verifier and registrar. Recommendations: For versions prior to 6.3.0, update to version 6.3.0 or lat...

PT-2022-16362 · Keylime · Keylime

Name of the Vulnerable Software and Affected Versions: Keylime versions prior to 6.3.0 Description: The issue concerns quote responses from the agent that can contain possibly untrusted ZIP data, leading to zip bombs. Recommendations: For versions prior to 6.3.0, update to version 6.3.0 or later ...

PT-2022-16361 · Keylime · Keylime

Name of the Vulnerable Software and Affected Versions: Keylime versions prior to 6.3.0 Description: The issue arises from the Revocation Notifier in Keylime using a fixed /tmp path for a UNIX domain socket. This can be exploited by unprivileged users to prohibit Keylime operations. Recommendation...

CVE-2022-23949: Authentication Bypass by Spoofing

In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar...

CVE-2021-43310: Authentication Bypass by Spoofing

A vulnerability in Keylime before 6.3.0 allows an attacker to craft a request to the agent that resets the U and V keys as if the agent were being re-added to a verifier. This could lead to a remote code execution...

PT-2022-11822 · Keylime · Keylime

Name of the Vulnerable Software and Affected Versions: Keylime versions prior to 6.3.0 Description: A vulnerability allows an attacker to craft a request to the agent that resets the U and V keys as if the agent were being re-added to a verifier, potentially leading to remote code execution...

CVE-2022-23950: Creation of Temporary File in Directory with Insecure Permissions

In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operations...

CVE-2022-23948: Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in Keylime before 6.3.0. The logic in the Keylime agent for checking for a secure mount can be fooled by previously created unprivileged mounts allowing secrets to be leaked to other processes on the host...