Improper Validation of Specified Type of Input Affecting keylime package, versions [7.12.0, 7.12.1)
Threat Intelligence
Exploit maturity not defined.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-KEYLIME-8730851
- published16 Feb 2025
- disclosed14 Feb 2025
- creditAnderson Toshiyuki Sasaki
Introduced: 14 Feb 2025
NewCVE-2025-1057 (opens in a new tab)How to fix?
Upgrade keylime to version 7.12.1 or higher.
Overview
keylime is a TPM-based key bootstrapping and system integrity measurement system for cloud
Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input due to the registrar process. An attacker can cause the application to fail by populating the database with multiple valid agent registrations with different UUIDs while the version is still below 7.12.0. Then, upon updating to version 7.12.0, any query to the database matching any of the entries populated by the attacker will result in failure.
Workaround
This vulnerability can be mitigated by removing the registrar database and re-registering all agents