CVE-2023-3674

Опубликовано: 19 июл. 2023

Источник: nvd

CVSS3: 2.3

CVSS3: 2.8

EPSS Низкий

Описание

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

Ссылки

https://access.redhat.com/errata/RHSA-2024:1139
https://access.redhat.com/security/cve/CVE-2023-3674
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2222903
Issue Tracking
Patch
Third Party Advisory
https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db
Patch
https://access.redhat.com/errata/RHSA-2024:1139
https://access.redhat.com/security/cve/CVE-2023-3674
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2222903
Issue Tracking
Patch
Third Party Advisory
https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db
Patch

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:keylime:keylime:*:*:*:*:*:*:*:*

Версия до 7.2.5 (исключая)

Конфигурация 2

cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

EPSS

Процентиль: 4%

0.00021

Низкий

2.3 Low

CVSS3

2.8 Low

CVSS3

Дефекты

CWE-1283

NVD-CWE-Other

Связанные уязвимости

CVE-2023-3674

CVSS3: 2.3

redhat

около 2 лет назад

RLSA-2024:1139

rocky

больше 1 года назад

Low: keylime security update

GHSA-g4wg-cfpf-9689

CVSS3: 2.3

github

около 2 лет назад

keylime fails to flag device as untrusted when signature does not validate

ELSA-2024-1139

oracle-oval

больше 1 года назад

ELSA-2024-1139: keylime security update (LOW)

EPSS

Процентиль: 4%

0.00021

Низкий

2.3 Low

CVSS3

2.8 Low

CVSS3

Дефекты

CWE-1283

NVD-CWE-Other