Puiterwijk

Name of the Vulnerable Software and Affected Versions: keylime versions 5.8.1 and older Description: A flaw was found in the Keylime agent and registrar code, which invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations. Recommendations: For keylime versions 5.8.1 and older, update to a version newer than 5.8.1 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** modulemd versions 1.3.1 and earlier **Description** The issue is related to the use of an unsafe function for processing externally provided data, which can lead to remote code execution. **Recommendations** For modulemd versions 1.3.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Koji version 1.13.0 **Description** The issue arises from improper validation of SCM paths, enabling an attacker to bypass blacklisted paths for build submission. **Recommendations** For version 1.13.0, update to a newer version that properly validates SCM paths to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** Pagure versions 3.3.0 and earlier **Description** The issue is related to improper authorization, leading to a loss of confidentiality. **Recommendations** For Pagure versions 3.3.0 and earlier, update to a version later than 3.3.0 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.