keylime@6.3.1 vulnerabilities

TPM-based key bootstrapping and system integrity measurement system for cloud

latest version

7.10.0

latest non vulnerable version

first published

2 years ago

latest version published

10 months ago

licenses detected

Apache-2.0
[0,)

View keylime package health on Snyk Advisor (opens in a new tab)

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the keylime package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Vulnerability	Vulnerable Version
M Authorization Bypass Through User-Controlled Key keylime is a TPM-based key bootstrapping and system integrity measurement system for cloud Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the `registrar` code, which allows an attacker to effectively bypass the challenge-response protocol used to verify that an agent has indeed access to an AIK, which in indeed related to the EK. When receiving the wrong `auth_tag` back from the agent during activation, the registrar answers with an error message containing the expected correct `auth_tag` (an HMAC calculated within the registrar for checking), which the attacker then uses. How to fix Authorization Bypass Through User-Controlled Key? Upgrade `keylime` to version 7.5.0 or higher.	[,7.5.0)
H Denial of Service (DoS) keylime is a TPM-based key bootstrapping and system integrity measurement system for cloud Affected versions of this package are vulnerable to Denial of Service (DoS) via SSL connections, which allows an attacker to exhaust all available connections. How to fix Denial of Service (DoS)? Upgrade `keylime` to version 7.4.0 or higher.	[,7.4.0)
L Mutable Attestation or Measurement Reporting Data keylime is a TPM-based key bootstrapping and system integrity measurement system for cloud Affected versions of this package are vulnerable to Mutable Attestation or Measurement Reporting Data due to attestation failure when the quote's signature does not validate. To exploit this vulnerability a non-privileged user would have to modify the keylime agent to create invalid quotes a could then use invalid measurement lists to hide the trust state of a system. The attacker would then have to trick the administrator into using the user's modified keylime agent. How to fix Mutable Attestation or Measurement Reporting Data? Upgrade `keylime` to version 7.4.0 or higher.	[,7.4.0)
M Denial of Service (DoS) keylime is a TPM-based key bootstrapping and system integrity measurement system for cloud Affected versions of this package are vulnerable to Denial of Service (DoS) via the `tornado_requests`. In some rare circumstances, an operating system level failure (such as a network driver crash) happens and `keylime` error handling procedures do not properly treat this situation. This causes the verifier component to quit and not recover. How to fix Denial of Service (DoS)? Upgrade `keylime` to version 6.5.1 or higher.	[,6.5.1)
H Improper Input Validation keylime is a TPM-based key bootstrapping and system integrity measurement system for cloud Affected versions of this package are vulnerable to Improper Input Validation in `Tenant` and `Verifier` which does not use the same registrar data. It allows an attacker to use one `AK`, `EK` pair from a real `TPM` to pass `EK` validation and give the verifier an `AK` of a software `TPM`. How to fix Improper Input Validation? Upgrade `keylime` to version 6.4.0 or higher.	[,6.4.0)

Go back to all versions of this package