CVE-2022-23949 - In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar

HIGH

In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar

Published Sep 21, 2022

7.5

HIGH

CVSS 3.1

EPSS 1.35%

In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Keylime

n/a

Version	Status	Constraints
keylime 6.3.0	affected	-

No remediation recorded yet.

Weaknesses (1)

CWE-290

Authentication Bypass by Spoofing

Link	Providers	Tags
https://github.com/keylime/keylime/commit/387e320dc22c89f4f47c68cb37eb9eec2137f34b		x_refsource_MISCPatchThird Party Advisory
https://github.com/keylime/keylime/commit/65c2b737129b5837f4a03660aeb1191ced275a57		x_refsource_MISCPatchThird Party Advisory
https://github.com/keylime/keylime/commit/e429e95329fc60608713ddfb82f4a92ee3b3d2d9		x_refsource_MISCPatchThird Party Advisory
https://github.com/keylime/keylime/security/advisories/GHSA-87gh-qc28-j9mm		x_refsource_MISCThird Party Advisory
https://seclists.org/oss-sec/2022/q1/101		x_refsource_MISCExploitMailing ListPatchThird Party Advisory