CVE-2023-38200 — Keylime: registrar is subject to a dos against ssl connections

Affected: Red Hat Enterprise Linux 9

A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.

GHSA-pg75-v6fp-8q59 — Keylime's registrar vulnerable to Denial-of-service attack via a single open connection

Affected: PyPI: keylime

### Impact Keylime `registrar` is prone to a simple denial of service attack in which an adversary opens a connection to the TLS port (by default, port `8891`) blocking further, legitimate connections. As long as the connection is open, the `registrar` is blocked and cannot serve any further clients (`agents` and `tenants`), which prevents normal operation. The problem does not affect the `verifier`.

### Patches Users should upgrade to release 7.4.0

Most recent entries from all

CVE-2023-38200 — Keylime: registrar is subject to a dos against ssl connections

GHSA-pg75-v6fp-8q59 — Keylime's registrar vulnerable to Denial-of-service attack via a single open connection