CVE-2022-1053
2 advisories.
PyPI/keylime CVE-2022-1053: critical 9.1
Tenant and Verifier might not use the same registrar data
Action: Upgrade keylime to 6.4.0 or later.
pip install keylime==6.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.4.0 | - |
Fixed versions
| 6.4.0 |
Sources
- osv: GHSA-jf66-3q76-h5p5
- https://github.com/keylime/keylime/security/advisories/GHSA-jf66-3q76-h5p5
- https://nvd.nist.gov/vuln/detail/CVE-2022-1053
- https://github.com/keylime/keylime/commit/bd5de712acdd77860e7dc58969181e16c7a8dc5d
- https://bugzilla.redhat.com/show_bug.cgi?id=2065024
- https://github.com/advisories/GHSA-jf66-3q76-h5p5
- https://github.com/keylime/keylime
- https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2022-184.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A7WAKVXM7L5D2DUACV6EHA6EJNAX2GVL
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RF6QHU4UGSBATC3HOOE7OP66CYVTR7CV
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WEW2PAXO5YGLDLPG45YV2OPLJXJSCECQ
CVE-2022-1053 · published · modified · JSON
PyPI/keylime CVE-2022-1053: unknown
Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows
Action: Upgrade keylime to 6.4.0 or later.
pip install keylime==6.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.4.0 | - |
Fixed versions
| 6.4.0 |
Sources
- osv: PYSEC-2022-184
- https://bugzilla.redhat.com/show_bug.cgi?id=2065024,
- https://github.com/keylime/keylime/commit/bd5de712acdd77860e7dc58969181e16c7a8dc5d
- https://github.com/keylime/keylime/security/advisories/GHSA-jf66-3q76-h5p5,
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A7WAKVXM7L5D2DUACV6EHA6EJNAX2GVL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WEW2PAXO5YGLDLPG45YV2OPLJXJSCECQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RF6QHU4UGSBATC3HOOE7OP66CYVTR7CV/
- https://github.com/advisories/GHSA-jf66-3q76-h5p5
CVE-2022-1053 · published · modified · JSON