keylime fails to flag device as untrusted when signature does not validate

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2023-3674 · ADVISORY
• keylime/keylime commit 95ce3d8 · WEB
• access.redhat.com/errata/RHSA-2024:1139 · WEB
• access.redhat.com/security/cve/CVE-2023-3674 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• keylime/keylime · PACKAGE
• pypa/advisory-database · WEB
• GitHub Advisory GHSA-g4wg-cfpf-9689 · ADVISORY

keylime のその他の脆弱性

• CVE-2026-6420中 6.3A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vuln…
• CVE-2026-1709緊急 9.8A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authen…
• CVE-2025-13609高 8.2A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted …
• CVE-2025-1057中 4.3A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar f…
• CVE-2023-38201中 6.5A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue…