diff --git a/advisories/github-reviewed/2025/02/GHSA-9jxq-5x44-gx23/GHSA-9jxq-5x44-gx23.json b/advisories/github-reviewed/2025/02/GHSA-9jxq-5x44-gx23/GHSA-9jxq-5x44-gx23.json new file mode 100644 index 00000000000..31d486abb16 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-9jxq-5x44-gx23/GHSA-9jxq-5x44-gx23.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9jxq-5x44-gx23", + "modified": "2025-02-14T18:03:14Z", + "published": "2025-02-14T18:03:14Z", + "aliases": [ + "CVE-2025-1057" + ], + "summary": "Keylime registrar is vulnerable to Denial-of-Service attack when updated to version 7.12.0", + "details": "### Impact\nThe Keylime `registrar` implemented more strict type checking on version 7.12.0. As a result, when updated to version 7.12.0, the `registrar` will not accept the format of the data previously stored in the database by versions >= 7.8.0, raising an exception.\n\nThis makes the Keylime `registrar` vulnerable to a Denial-of-Service attack in an update scenario, as an attacker could populate the `registrar` database by creating multiple valid agent registrations with different UUIDs while the version is still < 7.12.0. Then, when the Keylime `registrar` is updated to the 7.12.0 version, any query to the database matching any of the entries populated by the attacker will result in failure.\n\n### Patches\nUsers should upgrade to versions >= 7.12.1\n\n### Workarounds\n- Remove the registrar database and re-register all agents\n\n### Credit\n\nReported by: Anderson Toshiyuki Sasaki/@ansasaki\nPatched by: Anderson Toshiyuki Sasaki/@ansasaki", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "keylime" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.12.0" + }, + { + "fixed": "7.12.1" + } + ] + } + ], + "versions": [ + "7.12.0" + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/keylime/keylime/security/advisories/GHSA-9jxq-5x44-gx23" + }, + { + "type": "WEB", + "url": "https://github.com/keylime/keylime/commit/e08b10d86c3717006774e787542c190e2ba24fc7" + }, + { + "type": "PACKAGE", + "url": "https://github.com/keylime/keylime" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1287" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-02-14T18:03:14Z", + "nvd_published_at": null + } +} \ No newline at end of file