{"id":"CVE-2023-38200","aliases":["ALSA-2023:5080","EUVD-2023-2332","GHSA-pg75-v6fp-8q59","PYSEC-2026-1489","RHSA-2023:5080","SUSE-SU-2023:3245-1","openSUSE-SU-2024:13096-1"],"status":"published","title":"Keylime: registrar is subject to a dos against ssl connections","description":"A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01448,"percentile":0.73549,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-834"],"published":"2023-07-24T15:19:19Z","modified":"2026-10-29T11:31:30Z","fixes":[{"ecosystem":"PyPI","package":"keylime","fixed_in":["7.4.0"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"keylime","fixed_in":["6.3.2-150400.4.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"keylime","fixed_in":["6.3.2-150400.4.17.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"keylime","fixed_in":["6.3.2-150400.4.17.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"keylime","fixed_in":["6.3.2-150400.4.17.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-6.el9_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"keylime-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-6.el9_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"keylime-registrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-6.el9_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"keylime-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-6.el9_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"keylime-tenant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-6.el9_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"keylime-verifier","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-6.el9_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-6.el9_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0"}]}],"versions":["6.3.1","6.3.2","6.4.0","6.4.1","6.4.2","6.4.3","6.5.0","6.5.1","6.5.2","6.5.3","6.6.0","6.8.0","7.0.0","7.2.5","7.3.0"]},{"source":"osv","ecosystem":"PyPI","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0"}]}],"versions":["6.3.1","6.3.2","6.4.0","6.4.1","6.4.2","6.4.3","6.5.0","6.5.1","6.5.2","6.5.3","6.6.0","6.8.0","7.0.0","7.2.5","7.3.0"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.2-6.el9_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.2-6.el9_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime-registrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.2-6.el9_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.2-6.el9_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime-tenant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.2-6.el9_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime-verifier","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.2-6.el9_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.2-6.el9_2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.4.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.4.17.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.4.17.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.4.17.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"keylime","product":"keylime"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems"},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems_eus"},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian"},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian_eus"},{"vendor":"redhat","product":"enterprise_linux_server_aus"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:5080","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38200","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","report","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222692","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Third Party Advisory","web","report"]},{"url":"https://github.com/keylime/keylime/pull/1421","tags":["x_transferred","Patch","web","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZIZZB5NHNCS5D2AEH3ZAO6OQC72IK7WS/","tags":["x_transferred"]},{"url":"https://github.com/keylime/keylime/security/advisories/GHSA-pg75-v6fp-8q59","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38200","tags":["advisory"]},{"url":"https://github.com/keylime/keylime/commit/c68d8f0b7ea549c12b6956ab0f3c28ae0360ae17","tags":["web","fix"]},{"url":"https://github.com/keylime/keylime/releases/tag/v7.4.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pg75-v6fp-8q59","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38201","tags":["report"]},{"url":"https://bugzilla.redhat.com/2222692","tags":["report"]},{"url":"https://bugzilla.redhat.com/2222693","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-5080.html","tags":["advisory"]},{"url":"https://github.com/keylime/keylime","tags":["package"]},{"url":"https://pypi.org/project/keylime","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222693","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5080.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38200","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38201","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38201","tags":["advisory"]},{"url":"https://github.com/keylime/keylime/commit/9e5ac9f25cd400b16d5969f531cee28290543f2a","tags":["article"]},{"url":"https://github.com/keylime/keylime/security/advisories/GHSA-f4r5-q63f-gcww","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233245-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213310","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38200","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-38200","title":"Keylime: registrar is subject to a dos against ssl connections","description":"A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.","status":"published","published":"2023-07-24T15:19:19.291Z","modified":"2025-11-20T17:41:35.153Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:35:29.772612Z"}],"euvd":[{"id":"EUVD-2023-2332","description":"A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.","status":"published","published":"2023-07-24T15:19:19Z","modified":"2025-11-20T17:41:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:14.564249Z"}],"ghsa":[{"id":"GHSA-pg75-v6fp-8q59","title":"Keylime's registrar vulnerable to Denial-of-service attack via a single open connection","description":"### Impact\nKeylime `registrar` is prone to a simple denial of service attack in which an adversary opens a connection to the TLS port (by default, port `8891`) blocking further, legitimate connections. As long as the connection is open, the `registrar` is blocked and cannot serve any further clients (`agents` and `tenants`), which prevents normal operation. The problem does not affect the `verifier`.\n\n### Patches\nUsers should upgrade to release 7.4.0","status":"published","published":"2023-08-01T20:16:29Z","modified":"2023-09-04T05:04:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-834"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2023-38200","description":"A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.","status":"published","published":"2023-07-24T16:15:12.067Z","modified":"2026-06-17T06:09:39.093Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400","CWE-834"],"updated_at":"2026-11-02T14:08:18.687088Z"}],"osv":[{"id":"GHSA-pg75-v6fp-8q59","title":"Keylime's registrar vulnerable to Denial-of-service attack via a single open connection","description":"### Impact\nKeylime `registrar` is prone to a simple denial of service attack in which an adversary opens a connection to the TLS port (by default, port `8891`) blocking further, legitimate connections. As long as the connection is open, the `registrar` is blocked and cannot serve any further clients (`agents` and `tenants`), which prevents normal operation. The problem does not affect the `verifier`.\n\n### Patches\nUsers should upgrade to release 7.4.0","status":"published","published":"2023-08-01T20:16:29Z","modified":"2026-07-07T17:56:38.781897589Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-834"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"PYSEC-2026-1489","title":"Keylime's registrar vulnerable to Denial-of-service attack via a single open connection","description":"### Impact\nKeylime `registrar` is prone to a simple denial of service attack in which an adversary opens a connection to the TLS port (by default, port `8891`) blocking further, legitimate connections. As long as the connection is open, the `registrar` is blocked and cannot serve any further clients (`agents` and `tenants`), which prevents normal operation. The problem does not affect the `verifier`.\n\n### Patches\nUsers should upgrade to release 7.4.0","status":"published","published":"2026-07-07T11:45:21.483576Z","modified":"2026-07-07T17:46:35.187805562Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"RHSA-2023:5080","title":"Red Hat Security Advisory: keylime security update","status":"published","published":"2024-09-16T12:49:02Z","modified":"2025-11-22T12:55:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"ALSA-2023:5080","title":"Moderate: keylime security update","description":"Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.\n\nSecurity Fix(es):\n\n* keylime: registrar is subject to a DoS against SSL connections (CVE-2023-38200)\n* Keylime: challenge-response protocol bypass during agent registration (CVE-2023-38201)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-09-12T00:00:00Z","modified":"2026-10-29T11:31:30.63533526Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"openSUSE-SU-2024:13096-1","title":"keylime-config-7.4.0-1.1 on GA media","description":"These are all security issues fixed in the keylime-config-7.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:47:04.877359Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:3245-1","title":"Security update for keylime","description":"This update for keylime fixes the following issues:\n\n- CVE-2023-38200: Fixed a DoS attack against it's SSL connections. (bsc#1213310)\n","status":"published","published":"2023-08-08T16:21:09Z","modified":"2026-02-04T02:14:56.614398Z","updated_at":"2026-11-02T15:53:53.440387Z"}]}}