PyPI/keylime CVE-2022-1053: unknown, EPSS 1.48%
Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows
Action: Upgrade keylime to 6.4.0 or later.
pip install keylime==6.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.4.0 | - |
Fixed versions
| 6.4.0 |
Sources
- osv: PYSEC-2022-184
- https://bugzilla.redhat.com/show_bug.cgi?id=2065024,
- https://github.com/keylime/keylime/commit/bd5de712acdd77860e7dc58969181e16c7a8dc5d
- https://github.com/keylime/keylime/security/advisories/GHSA-jf66-3q76-h5p5,
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A7WAKVXM7L5D2DUACV6EHA6EJNAX2GVL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WEW2PAXO5YGLDLPG45YV2OPLJXJSCECQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RF6QHU4UGSBATC3HOOE7OP66CYVTR7CV/
- https://github.com/advisories/GHSA-jf66-3q76-h5p5
CVE-2022-1053 · published · modified · JSON