Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/keylime@6.3.2
Typepypi
Namespace
Namekeylime
Version6.3.2
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version7.12.2
Latest_non_vulnerable_version7.13.1
Affected_by_vulnerabilities
0
url VCID-bkzk-g3pz-6ka5
vulnerability_id VCID-bkzk-g3pz-6ka5
summary A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibility that a rogue agent could create errors on the verifier that stopped attestation attempts for that host leaving it in an attested state but not verifying that anymore.
references
0
reference_url https://access.redhat.com/security/cve/CVE-2022-3500
reference_id
reference_type
scores
url https://access.redhat.com/security/cve/CVE-2022-3500
1
reference_url https://github.com/keylime/keylime/pull/1128
reference_id
reference_type
scores
url https://github.com/keylime/keylime/pull/1128
fixed_packages
0
url pkg:pypi/keylime@6.5.1
purl pkg:pypi/keylime@6.5.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-brn1-4b8e-kqhf
1
vulnerability VCID-mqxg-478p-23cn
2
vulnerability VCID-v57m-t456-xkfd
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/keylime@6.5.1
aliases CVE-2022-3500, PYSEC-2022-42995
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bkzk-g3pz-6ka5
1
url VCID-brn1-4b8e-kqhf
vulnerability_id VCID-brn1-4b8e-kqhf
summary A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.
references
0
reference_url https://access.redhat.com/errata/RHSA-2023:5080
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:5080
1
reference_url https://access.redhat.com/security/cve/CVE-2023-38201
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
url https://access.redhat.com/security/cve/CVE-2023-38201
2
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2222693
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
url https://bugzilla.redhat.com/show_bug.cgi?id=2222693
3
reference_url https://github.com/keylime/keylime
reference_id
reference_type
scores
url https://github.com/keylime/keylime
4
reference_url https://github.com/keylime/keylime/commit/9e5ac9f25cd400b16d5969f531cee28290543f2a
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
url https://github.com/keylime/keylime/commit/9e5ac9f25cd400b16d5969f531cee28290543f2a
5
reference_url https://github.com/keylime/keylime/security/advisories/GHSA-f4r5-q63f-gcww
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
url https://github.com/keylime/keylime/security/advisories/GHSA-f4r5-q63f-gcww
6
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2023-160.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2023-160.yaml
7
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZIZZB5NHNCS5D2AEH3ZAO6OQC72IK7WS
reference_id
reference_type
scores
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZIZZB5NHNCS5D2AEH3ZAO6OQC72IK7WS
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-38201
reference_id CVE-2023-38201
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-38201
9
reference_url https://github.com/advisories/GHSA-f4r5-q63f-gcww
reference_id GHSA-f4r5-q63f-gcww
reference_type
scores
url https://github.com/advisories/GHSA-f4r5-q63f-gcww
fixed_packages
0
url pkg:pypi/keylime@7.5.0
purl pkg:pypi/keylime@7.5.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-mqxg-478p-23cn
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/keylime@7.5.0
aliases CVE-2023-38201, GHSA-f4r5-q63f-gcww, PYSEC-2023-160
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-brn1-4b8e-kqhf
2
url VCID-e4rm-c82g-fbff
vulnerability_id VCID-e4rm-c82g-fbff
summary Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an AK of a software TPM. A successful attack breaks the entire chain of trust because a not validated AK is used by the verifier. This issue is worse if the validation happens first and then the agent gets added to the verifier because the timing is easier and the verifier does not validate the regcount entry being equal to 1,
references
0
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2065024
reference_id
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2065024
1
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2065024,
reference_id
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2065024,
2
reference_url https://github.com/advisories/GHSA-jf66-3q76-h5p5
reference_id
reference_type
scores
url https://github.com/advisories/GHSA-jf66-3q76-h5p5
3
reference_url https://github.com/keylime/keylime
reference_id
reference_type
scores
url https://github.com/keylime/keylime
4
reference_url https://github.com/keylime/keylime/commit/bd5de712acdd77860e7dc58969181e16c7a8dc5d
reference_id
reference_type
scores
url https://github.com/keylime/keylime/commit/bd5de712acdd77860e7dc58969181e16c7a8dc5d
5
reference_url https://github.com/keylime/keylime/security/advisories/GHSA-jf66-3q76-h5p5,
reference_id
reference_type
scores
url https://github.com/keylime/keylime/security/advisories/GHSA-jf66-3q76-h5p5,
6
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2022-184.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2022-184.yaml
7
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A7WAKVXM7L5D2DUACV6EHA6EJNAX2GVL
reference_id
reference_type
scores
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A7WAKVXM7L5D2DUACV6EHA6EJNAX2GVL
8
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A7WAKVXM7L5D2DUACV6EHA6EJNAX2GVL/
reference_id
reference_type
scores
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A7WAKVXM7L5D2DUACV6EHA6EJNAX2GVL/
9
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RF6QHU4UGSBATC3HOOE7OP66CYVTR7CV
reference_id
reference_type
scores
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RF6QHU4UGSBATC3HOOE7OP66CYVTR7CV
10
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RF6QHU4UGSBATC3HOOE7OP66CYVTR7CV/
reference_id
reference_type
scores
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RF6QHU4UGSBATC3HOOE7OP66CYVTR7CV/
11
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WEW2PAXO5YGLDLPG45YV2OPLJXJSCECQ
reference_id
reference_type
scores
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WEW2PAXO5YGLDLPG45YV2OPLJXJSCECQ
12
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WEW2PAXO5YGLDLPG45YV2OPLJXJSCECQ/
reference_id
reference_type
scores
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WEW2PAXO5YGLDLPG45YV2OPLJXJSCECQ/
13
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-1053
reference_id CVE-2022-1053
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2022-1053
14
reference_url https://github.com/keylime/keylime/security/advisories/GHSA-jf66-3q76-h5p5
reference_id GHSA-jf66-3q76-h5p5
reference_type
scores
url https://github.com/keylime/keylime/security/advisories/GHSA-jf66-3q76-h5p5
fixed_packages
0
url pkg:pypi/keylime@6.4.0
purl pkg:pypi/keylime@6.4.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-bkzk-g3pz-6ka5
1
vulnerability VCID-brn1-4b8e-kqhf
2
vulnerability VCID-mqxg-478p-23cn
3
vulnerability VCID-v57m-t456-xkfd
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/keylime@6.4.0
aliases CVE-2022-1053, GHSA-jf66-3q76-h5p5, PYSEC-2022-184
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-e4rm-c82g-fbff
3
url VCID-mqxg-478p-23cn
vulnerability_id VCID-mqxg-478p-23cn
summary A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.
references
0
reference_url https://access.redhat.com/errata/RHSA-2026:2224
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/errata/RHSA-2026:2224
1
reference_url https://access.redhat.com/errata/RHSA-2026:2225
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/errata/RHSA-2026:2225
2
reference_url https://access.redhat.com/errata/RHSA-2026:2298
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/errata/RHSA-2026:2298
3
reference_url https://access.redhat.com/security/cve/CVE-2026-1709
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/security/cve/CVE-2026-1709
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2435514
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://bugzilla.redhat.com/show_bug.cgi?id=2435514
5
reference_url https://github.com/keylime/keylime
reference_id
reference_type
scores
url https://github.com/keylime/keylime
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-1709
reference_id CVE-2026-1709
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2026-1709
7
reference_url https://github.com/advisories/GHSA-4jqp-9qjv-57m2
reference_id GHSA-4jqp-9qjv-57m2
reference_type
scores
url https://github.com/advisories/GHSA-4jqp-9qjv-57m2
8
reference_url https://github.com/keylime/keylime/security/advisories/GHSA-4jqp-9qjv-57m2
reference_id GHSA-4jqp-9qjv-57m2
reference_type
scores
url https://github.com/keylime/keylime/security/advisories/GHSA-4jqp-9qjv-57m2
fixed_packages
0
url pkg:pypi/keylime@7.12.0
purl pkg:pypi/keylime@7.12.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-af9x-v3fm-3ffh
1
vulnerability VCID-mqxg-478p-23cn
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/keylime@7.12.0
1
url pkg:pypi/keylime@7.12.2
purl pkg:pypi/keylime@7.12.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/keylime@7.12.2
2
url pkg:pypi/keylime@7.13.1
purl pkg:pypi/keylime@7.13.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/keylime@7.13.1
aliases CVE-2026-1709, GHSA-4jqp-9qjv-57m2, PYSEC-2026-74
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mqxg-478p-23cn
4
url VCID-v57m-t456-xkfd
vulnerability_id VCID-v57m-t456-xkfd
summary A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.
references
0
reference_url https://access.redhat.com/errata/RHSA-2024:1139
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1139
1
reference_url https://access.redhat.com/security/cve/CVE-2023-3674
reference_id
reference_type
scores
0
value 2.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
url https://access.redhat.com/security/cve/CVE-2023-3674
2
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2222903
reference_id
reference_type
scores
0
value 2.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
url https://bugzilla.redhat.com/show_bug.cgi?id=2222903
3
reference_url https://github.com/keylime/keylime
reference_id
reference_type
scores
url https://github.com/keylime/keylime
4
reference_url https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db
reference_id
reference_type
scores
0
value 2.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
url https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db
5
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2023-128.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2023-128.yaml
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-3674
reference_id CVE-2023-3674
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-3674
7
reference_url https://github.com/advisories/GHSA-g4wg-cfpf-9689
reference_id GHSA-g4wg-cfpf-9689
reference_type
scores
url https://github.com/advisories/GHSA-g4wg-cfpf-9689
fixed_packages
0
url pkg:pypi/keylime@7.2.5
purl pkg:pypi/keylime@7.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-brn1-4b8e-kqhf
1
vulnerability VCID-mqxg-478p-23cn
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/keylime@7.2.5
aliases CVE-2023-3674, GHSA-g4wg-cfpf-9689, PYSEC-2023-128
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-v57m-t456-xkfd
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/keylime@6.3.2