Summary
[7.12.1-11.4]
- CVE-2026-1709: Registrar authentication bypass
Resolves: RHEL-145390
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | keylime | 0:7.12.1-11.el9_7.4 |
| Oracle Linux · 9 | keylime-base | 0:7.12.1-11.el9_7.4 |
| Oracle Linux · 9 | keylime-registrar | 0:7.12.1-11.el9_7.4 |
| Oracle Linux · 9 | keylime-selinux | 0:7.12.1-11.el9_7.4 |
| Oracle Linux · 9 | keylime-tenant | 0:7.12.1-11.el9_7.4 |
| Oracle Linux · 9 | keylime-verifier | 0:7.12.1-11.el9_7.4 |
| Oracle Linux · 9 | python3-keylime | 0:7.12.1-11.el9_7.4 |
Vulnerabilities 1
-
Critical 9.4
Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform admini…