Every CVE Search/ Get API key

CVE-2023-38200

Keylime: registrar is subject to a dos against ssl connections

7.5 HighFix available

A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.45%Up 1.4 points since Jul 25, 2023
90%50%10%1%

What each source reports

CVE List Score used 7.5

Keylime: registrar is subject to a dos against ssl connections

A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.

Record
CVE-2023-38200
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2023-2332 7.5

A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.

Record
EUVD-2023-2332
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-pg75-v6fp-8q59 7.5

Keylime's registrar vulnerable to Denial-of-service attack via a single open connection

Impact

Keylime registrar is prone to a simple denial of service attack in which an adversary opens a connection to the TLS port (by default, port 8891) blocking further, legitimate connections. As long as the connection is open, the registrar is blocked and cannot serve any further clients (agents and tenants), which prevents normal operation. The problem does not affect the verifier.

Patches

Users should upgrade to release 7.4.0

Record
GHSA-pg75-v6fp-8q59
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-834
Updated
2026-11-02
NVD 7.5

A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.

Record
CVE-2023-38200
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-834
Updated
2026-11-02
OSVGHSA-pg75-v6fp-8q59 7.5

Keylime's registrar vulnerable to Denial-of-service attack via a single open connection

Impact

Keylime registrar is prone to a simple denial of service attack in which an adversary opens a connection to the TLS port (by default, port 8891) blocking further, legitimate connections. As long as the connection is open, the registrar is blocked and cannot serve any further clients (agents and tenants), which prevents normal operation. The problem does not affect the verifier.

Patches

Users should upgrade to release 7.4.0

Record
GHSA-pg75-v6fp-8q59
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-834
Updated
2026-11-02
OSVPYSEC-2026-1489 7.5

Keylime's registrar vulnerable to Denial-of-service attack via a single open connection

Impact

Keylime registrar is prone to a simple denial of service attack in which an adversary opens a connection to the TLS port (by default, port 8891) blocking further, legitimate connections. As long as the connection is open, the registrar is blocked and cannot serve any further clients (agents and tenants), which prevents normal operation. The problem does not affect the verifier.

Patches

Users should upgrade to release 7.4.0

Record
PYSEC-2026-1489
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVRHSA-2023:5080 7.5

Red Hat Security Advisory: keylime security update

Record
RHSA-2023:5080
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2023:5080 No score

Moderate: keylime security update

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

Security Fix(es):

  • keylime: registrar is subject to a DoS against SSL connections (CVE-2023-38200)
  • Keylime: challenge-response protocol bypass during agent registration (CVE-2023-38201)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:5080
Updated
2026-11-02
OSVopenSUSE-SU-2024:13096-1 No score

keylime-config-7.4.0-1.1 on GA media

These are all security issues fixed in the keylime-config-7.4.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13096-1
Updated
2026-11-02
OSVSUSE-SU-2023:3245-1 No score

Security update for keylime

This update for keylime fixes the following issues:

  • CVE-2023-38200: Fixed a DoS attack against it's SSL connections. (bsc#1213310)
Record
SUSE-SU-2023:3245-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
keylime
PyPI
 before 7.4.0
7.4.0
keylime
AlmaLinux:9
From an advisory covering 2 CVEs
 before 6.5.2-6.el9_2.alma.1
6.5.2-6.el9_2.alma.1
keylime-base
AlmaLinux:9
From an advisory covering 2 CVEs
 before 6.5.2-6.el9_2.alma.1
6.5.2-6.el9_2.alma.1
keylime-registrar
AlmaLinux:9
From an advisory covering 2 CVEs
 before 6.5.2-6.el9_2.alma.1
6.5.2-6.el9_2.alma.1
keylime-selinux
AlmaLinux:9
From an advisory covering 2 CVEs
 before 6.5.2-6.el9_2.alma.1
6.5.2-6.el9_2.alma.1
keylime-tenant
AlmaLinux:9
From an advisory covering 2 CVEs
 before 6.5.2-6.el9_2.alma.1
6.5.2-6.el9_2.alma.1
keylime-verifier
AlmaLinux:9
From an advisory covering 2 CVEs
 before 6.5.2-6.el9_2.alma.1
6.5.2-6.el9_2.alma.1
python3-keylime
AlmaLinux:9
From an advisory covering 2 CVEs
 before 6.5.2-6.el9_2.alma.1
6.5.2-6.el9_2.alma.1
keylime
PyPI
 before 7.4.0, plus listed versions
6.3.16.3.26.4.06.4.16.4.2
Show 10 moreShow less
6.4.36.5.06.5.16.5.26.5.36.6.06.8.07.0.07.2.57.3.0
7.4.0
keylime
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:6.5.2-6.el9_2
0:6.5.2-6.el9_2
Show 10 moreShow less
Affected packages
PackageAffectedFixed
keylime-base
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:6.5.2-6.el9_2
0:6.5.2-6.el9_2
keylime-registrar
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:6.5.2-6.el9_2
0:6.5.2-6.el9_2
keylime-selinux
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:6.5.2-6.el9_2
0:6.5.2-6.el9_2
keylime-tenant
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:6.5.2-6.el9_2
0:6.5.2-6.el9_2
keylime-verifier
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:6.5.2-6.el9_2
0:6.5.2-6.el9_2
python3-keylime
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:6.5.2-6.el9_2
0:6.5.2-6.el9_2
keylime
SUSE:Linux Enterprise Module for Basesystem 15 SP4
 before 6.3.2-150400.4.17.1
6.3.2-150400.4.17.1
keylime
SUSE:Linux Enterprise Module for Basesystem 15 SP5
 before 6.3.2-150400.4.17.1
6.3.2-150400.4.17.1
keylime
openSUSE:Leap 15.4
 before 6.3.2-150400.4.17.1
6.3.2-150400.4.17.1
keylime
openSUSE:Leap 15.5
 before 6.3.2-150400.4.17.1
6.3.2-150400.4.17.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-38200 is a high vulnerability (CVSS 7.5) in Keylime, published July 24, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.45%, the 73rd percentile. Fixed in keylime 7.4.0.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open