CVE-2023-3674: Keylime: attestation failure when the quote's signature does not validate
First published: Wed Jul 12 2023(Updated: )
A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.
Credit: secalert@redhat.com secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/keylime | <7.2.5 | 7.2.5 |
| Keylime Keylime | <7.2.5 | |
| Fedoraproject Fedora | =38 | |
| redhat/keylime | <7.2.5 | 7.2.5 |
| redhat/keylime | <7.3.0 | 7.3.0 |
| <7.2.5 | ||
| =38 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2023-3674
- https://bugzilla.redhat.com/show_bug.cgi?id=2222903
- https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db
- https://www.cve.org/CVERecord?id=CVE-2023-3674 https://nvd.nist.gov/vuln/detail/CVE-2023-3674 https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db
- https://nvd.nist.gov/vuln/detail/CVE-2023-3674
- https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2023-128.yaml
- https://github.com/advisories/GHSA-g4wg-cfpf-9689 (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2222908
- https://access.redhat.com/errata/RHSA-2024:1139
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-3674.
What is the severity of CVE-2023-3674?
The severity of CVE-2023-3674 is low with a severity value of 2.3.
Which software is affected by CVE-2023-3674?
The keylime attestation verifier with versions up to 7.2.5 and 7.3.0 is affected by CVE-2023-3674.
How can I fix CVE-2023-3674?
To fix CVE-2023-3674, update the keylime attestation verifier to version 7.3.1 or later.
Where can I find more information about CVE-2023-3674?
You can find more information about CVE-2023-3674 at the following references: [Reference 1](https://access.redhat.com/security/cve/CVE-2023-3674), [Reference 2](https://bugzilla.redhat.com/show_bug.cgi?id=2222903), [Reference 3](https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db).
- collector/nvd-latest
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/remedy
- agent/first-publish-date
- agent/severity
- agent/author
- agent/title
- agent/weakness
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-3674
- agent/software-canonical-lookup
- agent/references
- agent/event
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- collector/nvd-api
- agent/software-canonical-lookup-request
- agent/tags
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-g4wg-cfpf-9689
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- vendor/keylime
- canonical/keylime keylime
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/38
- package-manager/redhat
- package-manager/pip