CVE-2022-23948

Katalog CVE

CVSS 7.5 · High EPSS 1,5%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada keylime. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in Keylime before 6.3.0. The logic in the Keylime agent for checking for a secure mount can be fooled by previously created unprivileged mounts allowing secrets to be leaked to other processes on the host.

Rincian

Terbit di NVD

21 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 72,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/keylime/keylime/commit/1a4f31a6368d651222683c9debe7d6832db6f607 patch · advisory pihak ketiga
• https://github.com/keylime/keylime/commit/d37c406e69cb6689baa2fb7964bad75209703724 patch · advisory pihak ketiga
• https://seclists.org/oss-sec/2022/q1/101 exploit · mailing list · patch · advisory pihak ketiga
• https://github.com/keylime/keylime/security/advisories/GHSA-wj36-qcfg-5j52 advisory pihak ketiga