GHSA-xh5w-g8gq-r3v9

Source

https://github.com/advisories/GHSA-xh5w-g8gq-r3v9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-xh5w-g8gq-r3v9/GHSA-xh5w-g8gq-r3v9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xh5w-g8gq-r3v9

Aliases

Published

2025-11-24T18:31:14Z

Modified

2026-05-29T21:00:16Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L CVSS Calculator

Summary

Keylime allows users to register new agents by recycling existing UUIDs when using different TPM devices

Details

A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.

Database specific

{
    "cwe_ids":  [
        "CWE-694"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-11-26T19:32:37Z",
    "nvd_published_at":  "2025-11-24T18:15:49Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / keylime

Package

Name: keylime; View open source insights on deps.dev
Purl: pkg:pypi/keylime

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

7.13.0

Affected versions

6.*

6.3.1

6.3.2

6.4.0

6.4.1

6.4.2

6.4.3

6.5.0

6.5.1

6.5.2

6.5.3

6.6.0

6.8.0

7.*

7.0.0

7.2.5

7.3.0

7.4.0

7.5.0

7.6.0

7.7.0

7.8.0

7.9.0

7.10.0

7.12.0

7.12.1

7.12.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-xh5w-g8gq-r3v9/GHSA-xh5w-g8gq-r3v9.json"