CVE-2022-23949
Publication date 21 September 2022
Last updated 25 August 2025
Ubuntu priority
Description
In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| keylime | 22.04 LTS jammy | Not in release |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.5 · High
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
References
Other references
- https://github.com/keylime/keylime/security/advisories/GHSA-87gh-qc28-j9mm
- https://github.com/keylime/keylime/commit/e429e95329fc60608713ddfb82f4a92ee3b3d2d9
- https://seclists.org/oss-sec/2022/q1/101
- https://github.com/keylime/keylime/commit/65c2b737129b5837f4a03660aeb1191ced275a57
- https://github.com/keylime/keylime/commit/387e320dc22c89f4f47c68cb37eb9eec2137f34b
- https://www.cve.org/CVERecord?id=CVE-2022-23949