PT-2022-16362 · Keylime · Keylime

Mgerstner + 1 · Published 2022-09-21 · Updated 2025-05-27 · CVE-2022-23951

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Keylime versions prior to 6.3.0

Description The issue concerns quote responses from the agent that can contain possibly untrusted ZIP data, leading to zip bombs.

Recommendations For versions prior to 6.3.0, update to version 6.3.0 or later to resolve the issue.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2022-23951

GHSA-6XX7-M45W-76M2

OPENSUSE-SU-2024:11785-1

Affected Products

Keylime

References · 7

• 🔥 https://seclists.org/oss-sec/2022/q1/101 · Exploit
• https://github.com/keylime/keylime/commit/6e44758b64b0ee13564fc46e807f4ba98091c355 · Patch
• https://osv.dev/vulnerability/CVE-2022-23951 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23951 · Security Note
• https://github.com/keylime/keylime/security/advisories/GHSA-6xx7-m45w-76m2 · Note
• https://t.me/cibsecurity/50237 · Telegram Post
• https://t.me/cvenotify/123758 · Telegram Post