CVE-2021-3406

Advisory

A flaw was found in keylime versions 5.8.1 and earlier. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations.

NOTE: The information in this advisory differs from what is publicly available at https://nvd.nist.gov/vuln/detail/CVE-2021-3406. The latter states, "A flaw was found in keylime 5.8.1 and older," which appears to be a typo, as indicated by the CPE values of this CVE.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/keylime/keylime/security/advisories/GHSA-78f8-6c68-375m
• https://bugzilla.redhat.com/show_bug.cgi?id=1932469
• https://lists.fedoraproject.org/archives/list/[email protected]/message/YAWKEF2LVXUME266T6RNRVBGAD375QAT/
• https://nvd.nist.gov/vuln/detail/CVE-2021-3406
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3406