PYSEC-2023-160
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/keylime/PYSEC-2023-160.yaml
- JSON Data
- https://api.test.osv.dev/v1/vulns/PYSEC-2023-160
- Aliases
- Published
- 2023-08-25T17:15:00Z
- Modified
- 2023-11-01T05:02:36.276414Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.
- References
Affected packages
PyPI / keylime
Package
- Name
- keylime
- View open source insights on deps.dev
- Purl
- pkg:pypi/keylime