Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

keylime

9 known vulnerabilities (1 critical, 2 high, 4 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 1 critical, 2 high, 4 medium, 1 low
Weekly downloads
371
Dependents
0
Registry
PyPI

Advisories 9

  • CVE-2026-6420Medium 6.3

    Keylime: keylime: security bypass due to hardcoded tpm quote nonce

    Affected: from 7.14.0, fixed in 7.14.2.

  • CVE-2026-1709Critical 9.4

    Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication

    Affected: fixed in 7.12.0; from 7.12.0, fixed in 7.12.2; from 7.13.0, fixed in 7.13.1.

  • Keylime: keylime: registrar allows identity takeover via duplicate uuid registration

    Affected: version range not reported; fixed in 7.13.0.

  • CVE-2025-1057Medium 4.3

    Keylime: keylime registrar dos due to incompatible database entry handling

    Affected: from 7.12.0, fixed in 7.12.1.

  • CVE-2023-38201Medium 6.5

    Keylime: challenge-response protocol bypass during agent registration

    Affected: fixed in 7.5.0.

  • Keylime: registrar is subject to a dos against ssl connections

    Affected: fixed in 7.4.0.

  • Keylime: attestation failure when the quote's signature does not validate

    Affected: fixed in 7.2.5; fixed in 7.2.5.

  • CVE-2022-3500Medium 5.1

    A vulnerability was found in keylime.

    Affected: fixed in 6.5.1.

  • Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and…

    Affected: fixed in 6.4.0.