Every CVE Search/ Get API key

CVE-2023-3674

Keylime: attestation failure when the quote's signature does not validate

2.3 LowFix available

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.21%Up 0.2 points since Jul 20, 2023
90%50%10%1%

What each source reports

CVE List Score used 2.3

Keylime: attestation failure when the quote's signature does not validate

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

Record
CVE-2023-3674
CVSS 3.1
2.3 LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-1283
Updated
2026-11-02
EUVDEUVD-2023-0105 2.3

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

Record
EUVD-2023-0105
CVSS 3.1
2.3 LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-g4wg-cfpf-9689 4.6

keylime fails to flag device as untrusted when signature does not validate

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

Record
GHSA-g4wg-cfpf-9689
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
2.3 LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-1283
Updated
2026-11-02
NVD 2.3

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

Record
CVE-2023-3674
CVSS 3.1
2.3 LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1
2.8 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-1283
Updated
2026-11-02
OSV 2.3

Keylime: attestation failure when the quote's signature does not validate

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

Record
CVE-2023-3674
CVSS 3.1
2.3 LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-1283
Updated
2026-11-02
OSVGHSA-g4wg-cfpf-9689 4.6

keylime fails to flag device as untrusted when signature does not validate

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

Record
GHSA-g4wg-cfpf-9689
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
2.3 LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-1283
Updated
2026-11-02
Show 5 moreShow less
OSVPYSEC-2023-128 2.8

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

Record
PYSEC-2023-128
CVSS 3.1
2.8 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVRHSA-2024:1139 2.3

Red Hat Security Advisory: keylime security update

Record
RHSA-2024:1139
CVSS 3.1
2.3 LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVALSA-2024:1139 No score

Low: keylime security update

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

Security Fix(es):

  • keylime: Attestation failure when the quote's signature does not validate (CVE-2023-3674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:1139
Updated
2026-11-02
OSVopenSUSE-SU-2024:14051-1 No score

keylime-config-7.11.0-1.1 on GA media

These are all security issues fixed in the keylime-config-7.11.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14051-1
Updated
2026-11-02
OSVRLSA-2024:1139 No score

Low: keylime security update

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

Security Fix(es):

  • keylime: Attestation failure when the quote's signature does not validate (CVE-2023-3674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2024:1139
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
keylime
PyPI
 before 7.2.5
7.2.5
keylime
AlmaLinux:9
 before 7.3.0-13.el9_3
7.3.0-13.el9_3
keylime-base
AlmaLinux:9
 before 7.3.0-13.el9_3
7.3.0-13.el9_3
keylime-registrar
AlmaLinux:9
 before 7.3.0-13.el9_3
7.3.0-13.el9_3
keylime-selinux
AlmaLinux:9
 before 7.3.0-13.el9_3
7.3.0-13.el9_3
keylime-tenant
AlmaLinux:9
 before 7.3.0-13.el9_3
7.3.0-13.el9_3
keylime-verifier
AlmaLinux:9
 before 7.3.0-13.el9_3
7.3.0-13.el9_3
python3-keylime
AlmaLinux:9
 before 7.3.0-13.el9_3
7.3.0-13.el9_3
keylime
PyPI
 before 7.2.5, plus listed versions
6.3.16.3.26.4.06.4.16.4.2
Show 8 moreShow less
6.4.36.5.06.5.16.5.26.5.36.6.06.8.07.0.0
7.2.5
keylime
PyPI
 before 7.2.5, plus listed versions
6.3.16.3.26.4.06.4.16.4.2
Show 45 moreShow less
6.4.36.5.06.5.16.5.26.5.36.6.06.8.07.0.0v7.3.0v7.2.5v6.5.0v7.0.0v6.7.0v6.6.0v6.5.3v6.5.2v5.8.2v6.5.1v6.4.3v6.4.2v6.4.1v6.4.0v6.3.2v6.3.1v6.3.0v6.2.1v6.2.06.1.16.1.06.0.16.0.0v5.8.15.8.15.8.0v4.0.15.7.35.7.25.7.15.7.05.6.25.6.15.6.05.5.05.4.15.4.0
7.2.5
Show 9 moreShow less
Affected packages
PackageAffectedFixed
keylime
Red Hat:enterprise_linux:9::appstream
 before 0:7.3.0-13.el9_3
0:7.3.0-13.el9_3
keylime-base
Red Hat:enterprise_linux:9::appstream
 before 0:7.3.0-13.el9_3
0:7.3.0-13.el9_3
keylime-registrar
Red Hat:enterprise_linux:9::appstream
 before 0:7.3.0-13.el9_3
0:7.3.0-13.el9_3
keylime-selinux
Red Hat:enterprise_linux:9::appstream
 before 0:7.3.0-13.el9_3
0:7.3.0-13.el9_3
keylime-tenant
Red Hat:enterprise_linux:9::appstream
 before 0:7.3.0-13.el9_3
0:7.3.0-13.el9_3
keylime-verifier
Red Hat:enterprise_linux:9::appstream
 before 0:7.3.0-13.el9_3
0:7.3.0-13.el9_3
python3-keylime
Red Hat:enterprise_linux:9::appstream
 before 0:7.3.0-13.el9_3
0:7.3.0-13.el9_3
keylime
Rocky Linux:9
 before 0:7.3.0-13.el9_3
0:7.3.0-13.el9_3
keylime
openSUSE:Tumbleweed
 before 7.11.0-1.1
7.11.0-1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-3674 is a low vulnerability (CVSS 2.3) in Keylime, published July 19, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in keylime 7.2.5.

References

Show 11 moreShow less
This page doesn't list everything

Left out here: 18 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open