CVSS 3.1
2.8 lowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:NCVE-2023-3674
Low (2.8). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in keylime 7.2.5.
A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1283
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- keylime:keylime
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-g4wg-cfpf-9689 | PyPI | keylime | <7.2.5 | 7.2.5 |
| PYSEC-2023-128 | PyPI | keylime | <7.2.5 | 7.2.5 |