PT-2025-6825 · Keylime · Keylime
Publicado
2025-02-14
·
Atualizado
2025-12-12
·
CVE-2025-1057
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Keylime versions 7.8.0 through 7.12.0
Description
The issue arises from the Keylime
registrar implementing stricter type checking in version 7.12.0, causing it to reject data formats previously stored in the database by versions 7.8.0 and later. This leads to a Denial-of-Service vulnerability, where an attacker can populate the database with multiple valid agent registrations before the update to 7.12.0, resulting in query failures after the update.Recommendations
For Keylime versions 7.8.0 through 7.12.0, upgrade to versions 7.12.1 or later.
As a temporary workaround, consider removing the registrar database and re-registering all agents to minimize the risk of exploitation.
Correção
Incorrect Type Conversion or Cast
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Keylime