Vulnerability Description
A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Keylime | Keylime | <= 5.8.1 |
| Fedoraproject | Fedora | 34 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1932469Issue TrackingThird Party Advisory
- https://github.com/keylime/keylime/security/advisories/GHSA-78f8-6c68-375mThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://bugzilla.redhat.com/show_bug.cgi?id=1932469Issue TrackingThird Party Advisory
- https://github.com/keylime/keylime/security/advisories/GHSA-78f8-6c68-375mThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2021-3406?
CVE-2021-3406 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations.
How severe is CVE-2021-3406?
CVE-2021-3406 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-3406?
Check the references section above for vendor advisories and patch information. Affected products include: Keylime Keylime, Fedoraproject Fedora.