A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
| Link | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2023:5080 | third party advisory vendor advisory |
| https://access.redhat.com/security/cve/CVE-2023-38201 | third party advisory vdb entry |
| https://bugzilla.redhat.com/show_bug.cgi?id=2222693 | patch third party advisory issue tracking |
| https://github.com/keylime/keylime/commit/9e5ac9f25cd400b16d5969f531cee28290543f2a | patch |
| https://github.com/keylime/keylime/security/advisories/GHSA-f4r5-q63f-gcww | vendor advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZIZZB5NHNCS5D2AEH3ZAO6OQC72IK7WS/ |