PT-2022-16359 · Keylime · Keylime

Matthias Gerstner · Published 2022-09-21 · Updated 2025-05-27 · CVE-2022-23949

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keylime versions prior to 6.3.0

Description The issue allows unsanitized UUIDs to be passed by a rogue agent, leading to log spoofing on the verifier and registrar.

Recommendations For versions prior to 6.3.0, update to version 6.3.0 or later to resolve the issue.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2022-23949

GHSA-87GH-QC28-J9MM

OPENSUSE-SU-2024:11785-1

Affected Products

Keylime

References · 9

• 🔥 https://seclists.org/oss-sec/2022/q1/101 · Exploit
• https://github.com/keylime/keylime/commit/e429e95329fc60608713ddfb82f4a92ee3b3d2d9 · Patch
• https://github.com/keylime/keylime/commit/65c2b737129b5837f4a03660aeb1191ced275a57 · Patch
• https://github.com/keylime/keylime/commit/387e320dc22c89f4f47c68cb37eb9eec2137f34b · Patch
• https://osv.dev/vulnerability/CVE-2022-23949 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23949 · Security Note
• https://github.com/keylime/keylime/security/advisories/GHSA-87gh-qc28-j9mm · Note
• https://t.me/cvenotify/123756 · Telegram Post
• https://t.me/cibsecurity/50234 · Telegram Post