Description
In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a keylime
keylime 6.3.0affected
References
- https://seclists.org/oss-sec/2022/q1/101 ↗
- https://github.com/keylime/keylime/security/advisories/GHSA-87gh-qc28-j9mm ↗
- https://github.com/keylime/keylime/commit/387e320dc22c89f4f47c68cb37eb9eec2137f34b ↗
- https://github.com/keylime/keylime/commit/e429e95329fc60608713ddfb82f4a92ee3b3d2d9 ↗
- https://github.com/keylime/keylime/commit/65c2b737129b5837f4a03660aeb1191ced275a57 ↗