id: PYSEC-2025-77
published: "2025-11-24T18:15:49.830Z"
modified: "2026-04-15T00:35:42.020Z"
aliases:
- CVE-2025-13609
- GHSA-xh5w-g8gq-r3v9
details: A vulnerability has been identified in keylime where an attacker can exploit
  this flaw by registering a new agent using a different Trusted Platform Module (TPM)
  device but claiming an existing agent's unique identifier (UUID). This action overwrites
  the legitimate agent's identity, enabling the attacker to impersonate the compromised
  agent and potentially bypass security controls.
affected:
- package:
    name: keylime
    ecosystem: PyPI
    purl: pkg:pypi/keylime
references:
- type: WEB
  url: https://access.redhat.com/security/cve/CVE-2025-13609
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2025:23201
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2025:23210
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2025:23628
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2025:23735
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2025:23852
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2026:0429
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=2416761
- type: REPORT
  url: https://github.com/keylime/keylime/issues/1820
- type: ADVISORY
  url: https://github.com/advisories/GHSA-xh5w-g8gq-r3v9
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L