CVE-2023-38201

2023-08-2500:00:00

ubuntu.com

keylime registrar

bypass

challenge-response protocol

agent registration

attacker

impersonate

breach

integrity

database

6.5 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.0005 Low

EPSS

Percentile

19.1%

JSON

A flaw was found in the Keylime registrar that could allow a bypass of the
challenge-response protocol during agent registration. This issue may allow
an attacker to impersonate an agent and hide the true status of a monitored
machine if the fake agent is added to the verifier list by a legitimate
user, resulting in a breach of the integrity of the registrar database.