~ / search / GHSA-pg75-v6fp-8q59

GHSA-pg75-v6fp-8q59

Keylime's registrar vulnerable to Denial-of-service attack via a single open connection

Source: GitHub Advisory Database (reviewed) High CVE-2023-38200

Packages

EcosystemPackageAffectedFixed in
PyPI keylime < 7.4.0 7.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Keylime `registrar` is prone to a simple denial of service attack in which an adversary opens a connection to the TLS port (by default, port `8891`) blocking further, legitimate connections. As long as the connection is open, the `registrar` is blocked and cannot serve any further clients (`agents` and `tenants`), which prevents normal operation. The problem does not affect the `verifier`. ### Patches Users should upgrade to release 7.4.0

References

External links from the advisory. They lead to third-party sites.