A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2023:5080 | Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2023-38201 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2222693 | Issue Tracking Patch Third Party Advisory |
| https://github.com/keylime/keylime/commit/9e5ac9f25cd400b16d5969f531cee28290543f2a | Patch |
| https://github.com/keylime/keylime/security/advisories/GHSA-f4r5-q63f-gcww | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
16 Sep 2024, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
12 Jan 2024, 22:01
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Redhat enterprise Linux For Ibm Z Systems Eus
Fedoraproject fedora Fedoraproject Redhat enterprise Linux Eus Redhat enterprise Linux For Power Little Endian Eus Redhat enterprise Linux Server Aus Redhat enterprise Linux For Power Little Endian Redhat enterprise Linux For Ibm Z Systems |
|
| CPE | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* |
|
| References | (MISC) https://access.redhat.com/errata/RHSA-2023:5080 - Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZIZZB5NHNCS5D2AEH3ZAO6OQC72IK7WS/ - Mailing List, Third Party Advisory |
12 Nov 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
12 Sep 2023, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
05 Sep 2023, 19:13
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Redhat
Keylime Redhat enterprise Linux Keylime keylime |
|
| References | (MISC) https://access.redhat.com/security/cve/CVE-2023-38201 - Third Party Advisory | |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2222693 - Issue Tracking, Patch, Third Party Advisory | |
| References | (MISC) https://github.com/keylime/keylime/security/advisories/GHSA-f4r5-q63f-gcww - Vendor Advisory | |
| References | (MISC) https://github.com/keylime/keylime/commit/9e5ac9f25cd400b16d5969f531cee28290543f2a - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:a:keylime:keylime:*:*:*:*:*:*:*:* |
25 Aug 2023, 17:51
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-25 17:15
Updated : 2024-09-16 13:15
NVD link : CVE-2023-38201
Mitre link : CVE-2023-38201
CVE.ORG link : CVE-2023-38201
JSON object : View
Products Affected
redhat
- enterprise_linux
- enterprise_linux_for_power_little_endian
- enterprise_linux_for_power_little_endian_eus
- enterprise_linux_server_aus
- enterprise_linux_for_ibm_z_systems_eus
- enterprise_linux_for_ibm_z_systems
- enterprise_linux_eus
keylime
- keylime
fedoraproject
- fedora
CWE