Homepage

Use of Multiple Resources with Duplicate Identifier The advisory has been revoked - it doesn't affect any version of package python3-keylime  (opens in a new tab)

Threat Intelligence

EPSS
0.47% (41st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALMALINUX10-PYTHON3KEYLIME-14551116
  • published23 Dec 2025
  • disclosed15 Dec 2025
Report a new vulnerability Found a mistake?

Introduced: 15 Dec 2025

CVE-2025-13609  (opens in a new tab)
CWE-694  (opens in a new tab)

Amendment

The AlmaLinux security team deemed this advisory irrelevant for AlmaLinux:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream python3-keylime package and not the python3-keylime package as distributed by AlmaLinux.

A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.