CVE-2022-23951 : In Keylime before 6.3.0, quote responses from the agent can contain possibly unt

In Keylime before 6.3.0, quote responses from the agent can contain possibly untrusted ZIP data which can lead to zip bombs.

Published 2022-09-21 19:15:10

Updated 2022-12-21 15:01:20

Source Fedora Project

View at NVD, CVE.org

Products affected by CVE-2022-23951

Keylime » Keylime
Versions before (<) 6.3.0
cpe:2.3:a:keylime:keylime:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.03%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 4 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

Assigned by: patrick@puiterwijk.org (Secondary)

https://github.com/keylime/keylime/security/advisories/GHSA-6xx7-m45w-76m2

Keylime: Quote responses subject to Zip bomb attacks · Advisory · keylime/keylime · GitHub
Third Party Advisory
https://seclists.org/oss-sec/2022/q1/101

oss-sec: keylime: Multiple Security Issues (including remote code execution in the Agent component)
Exploit;Mailing List;Patch;Third Party Advisory

CVEs referencing this url
https://github.com/keylime/keylime/commit/6e44758b64b0ee13564fc46e807f4ba98091c355

tpm: do not compress quote with zlib by default · keylime/keylime@6e44758 · GitHub
Patch;Third Party Advisory

Jump to