CVE-2023-3674

Katalog CVE

CVSS 2.8 · Low EPSS 0,21%

Kerentanan Mutable Attestation or Measurement Reporting Data pada keylime, fedoraproject fedora. Skor CVSS 3.1 2.8 (Low) menurut NVD.

Deskripsi (NVD)

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

Rincian

Terbit di NVD

19 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

2.8 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1283: Mutable Attestation or Measurement Reporting Data

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=2222903 issue tracking · patch · advisory pihak ketiga
• https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db patch
• https://access.redhat.com/security/cve/CVE-2023-3674 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2024:1139