by Kastro
Paper/Archive/CVE-2021-3406

CVE-2021-3406

redhat — A flaw was found in keylime 5.8.1 and older.

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 51.5.515 × 2010.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations.

Affected

ProductAffectedFixed inSource
keylime5.8.1 and older–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refbugzilla.redhat.com/show_bug.cgi?id=1932469refgithub.com/keylime/keylime/security/advisories/GHSA-78f8-6c68-375madvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YAWKEF2LVXUME266T6RNRVBGAD375QAT