PT-2026-6361 · Go · Github.Com/Lf-Edge/Eve

Published 2026-02-04 · Updated 2026-02-04

OSV

CVSS v3.1

6.7

Medium

Base vector

AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Impact

The vault key is sealed using SHA1 PCRs instead of SHA256 PCRs

Thus an attacker with physical access to an EVE-OS device can try to brute force creating a kernel or rootfs image which produces the same SHA1 PCR but with malicious content.

Patches

Fixed in 9.4.3-lts and 10.1.0

Workarounds

None

Fix

Insufficiently Protected Credentials

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-522

CWE-327

CWE-328

Related Identifiers

GHSA-4JVR-VJ2C-8Q37

Affected Products

Github.Com/Lf-Edge/Eve

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-43635 · Security Note
• https://osv.dev/vulnerability/GHSA-4jvr-vj2c-8q37 · Vendor Advisory
• https://github.com/lf-edge/eve/security/advisories/GHSA-4jvr-vj2c-8q37 · Note
• https://github.com/lf-edge/eve · Note
• https://asrg.io/security-advisories/vault-key-sealed-with-sha1-pcrs · Note
• https://asrg.io/security-advisories/cve-2023-43635 · Note