Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/keylime@7.4.0
Typepypi
Namespace
Namekeylime
Version7.4.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_versionnull
Latest_non_vulnerable_versionnull
Affected_by_vulnerabilities
0
url VCID-brn1-4b8e-kqhf
vulnerability_id VCID-brn1-4b8e-kqhf
summary A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.
references
0
reference_url https://access.redhat.com/errata/RHSA-2023:5080
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:5080
1
reference_url https://access.redhat.com/security/cve/CVE-2023-38201
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
url https://access.redhat.com/security/cve/CVE-2023-38201
2
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2222693
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
url https://bugzilla.redhat.com/show_bug.cgi?id=2222693
3
reference_url https://github.com/keylime/keylime
reference_id
reference_type
scores
url https://github.com/keylime/keylime
4
reference_url https://github.com/keylime/keylime/commit/9e5ac9f25cd400b16d5969f531cee28290543f2a
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
url https://github.com/keylime/keylime/commit/9e5ac9f25cd400b16d5969f531cee28290543f2a
5
reference_url https://github.com/keylime/keylime/security/advisories/GHSA-f4r5-q63f-gcww
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
url https://github.com/keylime/keylime/security/advisories/GHSA-f4r5-q63f-gcww
6
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2023-160.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2023-160.yaml
7
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZIZZB5NHNCS5D2AEH3ZAO6OQC72IK7WS
reference_id
reference_type
scores
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZIZZB5NHNCS5D2AEH3ZAO6OQC72IK7WS
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-38201
reference_id CVE-2023-38201
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-38201
9
reference_url https://github.com/advisories/GHSA-f4r5-q63f-gcww
reference_id GHSA-f4r5-q63f-gcww
reference_type
scores
url https://github.com/advisories/GHSA-f4r5-q63f-gcww
fixed_packages
0
url pkg:pypi/keylime@7.5.0
purl pkg:pypi/keylime@7.5.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-mqxg-478p-23cn
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/keylime@7.5.0
aliases CVE-2023-38201, GHSA-f4r5-q63f-gcww, PYSEC-2023-160
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-brn1-4b8e-kqhf
1
url VCID-mqxg-478p-23cn
vulnerability_id VCID-mqxg-478p-23cn
summary A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.
references
0
reference_url https://access.redhat.com/errata/RHSA-2026:2224
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/errata/RHSA-2026:2224
1
reference_url https://access.redhat.com/errata/RHSA-2026:2225
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/errata/RHSA-2026:2225
2
reference_url https://access.redhat.com/errata/RHSA-2026:2298
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/errata/RHSA-2026:2298
3
reference_url https://access.redhat.com/security/cve/CVE-2026-1709
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/security/cve/CVE-2026-1709
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2435514
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://bugzilla.redhat.com/show_bug.cgi?id=2435514
5
reference_url https://github.com/keylime/keylime
reference_id
reference_type
scores
url https://github.com/keylime/keylime
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-1709
reference_id CVE-2026-1709
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2026-1709
7
reference_url https://github.com/advisories/GHSA-4jqp-9qjv-57m2
reference_id GHSA-4jqp-9qjv-57m2
reference_type
scores
url https://github.com/advisories/GHSA-4jqp-9qjv-57m2
8
reference_url https://github.com/keylime/keylime/security/advisories/GHSA-4jqp-9qjv-57m2
reference_id GHSA-4jqp-9qjv-57m2
reference_type
scores
url https://github.com/keylime/keylime/security/advisories/GHSA-4jqp-9qjv-57m2
fixed_packages
0
url pkg:pypi/keylime@7.12.2
purl pkg:pypi/keylime@7.12.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/keylime@7.12.2
1
url pkg:pypi/keylime@7.13.1
purl pkg:pypi/keylime@7.13.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/keylime@7.13.1
2
url pkg:pypi/keylime@7.12.0
purl pkg:pypi/keylime@7.12.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-af9x-v3fm-3ffh
1
vulnerability VCID-mqxg-478p-23cn
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/keylime@7.12.0
aliases CVE-2026-1709, GHSA-4jqp-9qjv-57m2, PYSEC-2026-74
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mqxg-478p-23cn
Fixing_vulnerabilities
0
url VCID-qv61-fua6-bfat
vulnerability_id VCID-qv61-fua6-bfat
summary 
Excessive Iteration
A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.
references
0
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2222692
reference_id
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2222692
1
reference_url https://github.com/keylime/keylime/commit/c68d8f0b7ea549c12b6956ab0f3c28ae0360ae17
reference_id
reference_type
scores
url https://github.com/keylime/keylime/commit/c68d8f0b7ea549c12b6956ab0f3c28ae0360ae17
2
reference_url https://github.com/keylime/keylime/pull/1421
reference_id
reference_type
scores
url https://github.com/keylime/keylime/pull/1421
3
reference_url https://github.com/keylime/keylime/releases/tag/v7.4.0
reference_id
reference_type
scores
url https://github.com/keylime/keylime/releases/tag/v7.4.0
4
reference_url https://access.redhat.com/security/cve/CVE-2023-38200
reference_id CVE-2023-38200
reference_type
scores
url https://access.redhat.com/security/cve/CVE-2023-38200
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-38200
reference_id CVE-2023-38200
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-38200
6
reference_url https://github.com/advisories/GHSA-pg75-v6fp-8q59
reference_id GHSA-pg75-v6fp-8q59
reference_type
scores
url https://github.com/advisories/GHSA-pg75-v6fp-8q59
7
reference_url https://github.com/keylime/keylime/security/advisories/GHSA-pg75-v6fp-8q59
reference_id GHSA-pg75-v6fp-8q59
reference_type
scores
url https://github.com/keylime/keylime/security/advisories/GHSA-pg75-v6fp-8q59
fixed_packages
0
url pkg:pypi/keylime@7.4.0
purl pkg:pypi/keylime@7.4.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-brn1-4b8e-kqhf
1
vulnerability VCID-mqxg-478p-23cn
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/keylime@7.4.0
aliases CVE-2023-38200, GHSA-pg75-v6fp-8q59
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qv61-fua6-bfat
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/keylime@7.4.0