~ / search / GHSA-4jvr-vj2c-8q37

GHSA-4jvr-vj2c-8q37

EVE Seals Vault Key With SHA1 PCRs

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-43635

Packages

EcosystemPackageAffectedFixed in
Go github.com/lf-edge/eve < 0.0.0-20230519072751-977f42b07fa9 0.0.0-20230519072751-977f42b07fa9

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The vault key is sealed using SHA1 PCRs instead of SHA256 PCRs Thus an attacker with physical access to an EVE-OS device can try to brute force creating a kernel or rootfs image which produces the same SHA1 PCR but with malicious content. ### Patches Fixed in 9.4.3-lts and 10.1.0 ### Workarounds None

References

External links from the advisory. They lead to third-party sites.