Description
A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibility that a rogue agent could create errors on the verifier that stopped attestation attempts for that host leaving it in an attested state but not verifying that anymore.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | keylime | keylime 6.5.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | keylime +6 | 6.5.1-1.el9_1 | RHSA-2022:8444 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | keylime +6 | 6.5.1-1.el9_1 | ALSA-2022:8444 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | keylime | 6.5.1-1.el9_1.4 | RLSA-2022:8444 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | keylime | 6.3.2-150400.4.14.1 | SUSE-SU-2022:4204-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | keylime | 6.3.2-150400.4.14.1 | SUSE-SU-2022:4204-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | keylime +6 | 6.5.1-1.el9_1 | ELSA-2022-8444 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | keylime | < 6.5.1 | 6.5.1 | GHSA-hff2-x2j9-gxgv |
Advisories 6
- ALSA-2022:8444 Moderate: keylime security update AlmaLinux Security Advisories · Oct 29, 2026
- RLSA-2022:8444 Moderate: keylime security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2022:4204-1 Security update for keylime SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2022:8444 Red Hat Security Advisory: keylime security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- WID-SEC-2022-2052 Mehrere Red Hat Enterprise Linux Pakete: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 29, 2025
- ELSA-2022-8444 Moderate: keylime security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 24, 2022
References
- https://access.redhat.com/security/cve/CVE-2022-3500
- https://github.com/keylime/keylime/pull/1128
- FEDORA-2022-5a6ed3607d vendor-advisory
- FEDORA-2022-7a312cde45 vendor-advisory
- FEDORA-2022-8ad3246cc0 vendor-advisory