id: PYSEC-2023-128
modified: 2023-07-28T16:31:09.279625Z
published: 2023-07-19T19:15:00Z
aliases:
- CVE-2023-3674
- GHSA-g4wg-cfpf-9689
details: A flaw was found in the keylime attestation verifier, which fails to flag
  a device's submitted TPM quote as faulty when the quote's signature does not validate
  for some reason. Instead, it will only emit an error in the log without flagging
  the device as untrusted.
affected:
- package:
    ecosystem: PyPI
    name: keylime
    purl: pkg:pypi/keylime
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: 95ce3d86bd2c53009108ffda2dcf553312d733db
    repo: https://github.com/keylime/keylime
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 7.2.5
  versions:
  - 6.3.1
  - 6.3.2
  - 6.4.0
  - 6.4.1
  - 6.4.2
  - 6.4.3
  - 6.5.0
  - 6.5.1
  - 6.5.2
  - 6.5.3
  - 6.6.0
  - 6.8.0
  - 7.0.0
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
references:
- type: WEB
  url: https://access.redhat.com/security/cve/CVE-2023-3674
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=2222903
- type: FIX
  url: https://bugzilla.redhat.com/show_bug.cgi?id=2222903
- type: FIX
  url: 
    https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db
- type: ADVISORY
  url: https://github.com/advisories/GHSA-g4wg-cfpf-9689