Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication

A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

未进行实体认证的密钥交换

Keylime 安全漏洞

Keylime是Keylime开源的一个利用 TPM 技术的开源可扩展信任系统。 Keylime 7.12.0及之前版本存在安全漏洞，该漏洞源于未强制执行客户端TLS身份验证，可能导致未经验证的客户端执行管理操作。

N/A

N/A