Vulnerability-Lookup

CVE-2025-1057 (GCVE-0-2025-1057)

Vulnerability from cvelistv5 – Published: 2025-03-15 08:50 – Updated: 2026-06-29 23:25

Title

Keylime: keylime registrar dos due to incompatible database entry handling

Summary

A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar from reading database entries created by previous versions, for example, 7.11.0. Specifically, older versions store agent registration data as bytes, whereas the updated registrar expects str. This issue leads to an exception when processing agent registration requests, causing the agent to fail.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-17 17:01 UTC

CWE

CWE-704 - Incorrect Type Conversion or Cast

Assigner

redhat redhat root

References

4 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2025-1057	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2343894	issue-trackingx_refsource_REDHAT
https://github.com/ansasaki/keylime/tree/base64_bytes
https://github.com/keylime/rust-keylime

Impacted products

3 products

Vendor	Product	Version
		Affected: 7.12.0 (semver)
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2025-02-05 00:00

Credits

Red Hat would like to thank Anderson Toshiyuki Sasaki for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1057",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-17T17:01:10.891516Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-17T17:01:26.257Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/keylime/keylime",
          "defaultStatus": "unaffected",
          "packageName": "keylime",
          "versions": [
            {
              "status": "affected",
              "version": "7.12.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keylime",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keylime",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Anderson Toshiyuki Sasaki for reporting this issue."
        }
      ],
      "datePublic": "2025-02-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar from reading database entries created by previous versions, for example, 7.11.0. Specifically, older versions store agent registration data as bytes, whereas the updated registrar expects str. This issue leads to an exception when processing agent registration requests, causing the agent to fail."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-704",
              "description": "Incorrect Type Conversion or Cast",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T23:25:05.421Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-1057"
        },
        {
          "name": "RHBZ#2343894",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2343894"
        },
        {
          "url": "https://github.com/ansasaki/keylime/tree/base64_bytes"
        },
        {
          "url": "https://github.com/keylime/rust-keylime"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-02-05T09:47:52.149Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-02-05T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Keylime: keylime registrar dos due to incompatible database entry handling",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-704: Incorrect Type Conversion or Cast"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-1057",
    "datePublished": "2025-03-15T08:50:48.649Z",
    "dateReserved": "2025-02-05T09:57:50.746Z",
    "dateUpdated": "2026-06-29T23:25:05.421Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-1057",
      "date": "2026-09-14",
      "epss": "0.00384",
      "percentile": "0.31927"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-1057\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2025-03-15T09:15:10.770\",\"lastModified\":\"2026-06-30T00:16:54.380\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar from reading database entries created by previous versions, for example, 7.11.0. Specifically, older versions store agent registration data as bytes, whereas the updated registrar expects str. This issue leads to an exception when processing agent registration requests, causing the agent to fail.\"},{\"lang\":\"es\",\"value\":\"Se detect\u00f3 una falla en Keylime, una soluci\u00f3n de atestaci\u00f3n remota, donde la comprobaci\u00f3n estricta de tipos introducida en la versi\u00f3n 7.12.0 impide que el registrador lea las entradas de la base de datos creadas por versiones anteriores, por ejemplo, la 7.11.0. En concreto, las versiones anteriores almacenan los datos de registro del agente como bytes, mientras que el registrador actualizado espera str. Este problema genera una excepci\u00f3n al procesar las solicitudes de registro del agente, lo que provoca un fallo en el agente.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com/keylime/keylime\",\"packageName\":\"keylime\",\"versions\":[{\"version\":\"7.12.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"keylime\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"keylime\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-03-17T17:01:10.891516Z\",\"id\":\"CVE-2025-1057\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-704\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/security/cve/CVE-2025-1057\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2343894\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/ansasaki/keylime/tree/base64_bytes\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/keylime/rust-keylime\",\"source\":\"secalert@redhat.com\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T03:04:41+00:00",
      "cve": "CVE-2025-1057",
      "id": "CVE-2025-1057",
      "initial_release_date": "2025-02-05T00:00:00+00:00",
      "product_status:known_not_affected": "17",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "keylime: Keylime Registrar DoS Due to Incompatible Database Entry Handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-1057.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:11:09Z",
      "cve": "CVE-2025-1057",
      "id": "CVE-2025-1057",
      "initial_release_date": "2025-02-14T03:52:24Z",
      "product_status:known_not_affected": "172",
      "product_status:recommended": "42",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-1057",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-1057.json",
      "version": "22"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-1057\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-17T17:01:10.891516Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-17T17:01:17.753Z\"}}], \"cna\": {\"title\": \"Keylime: keylime registrar dos due to incompatible database entry handling\", \"credits\": [{\"lang\": \"en\", \"value\": \"Red Hat would like to thank Anderson Toshiyuki Sasaki for reporting this issue.\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"versions\": [{\"status\": \"affected\", \"version\": \"7.12.0\", \"versionType\": \"semver\"}], \"packageName\": \"keylime\", \"collectionURL\": \"https://github.com/keylime/keylime\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"keylime\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"keylime\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-02-05T09:47:52.149Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2025-02-05T00:00:00.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2025-02-05T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2025-1057\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2343894\", \"name\": \"RHBZ#2343894\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://github.com/ansasaki/keylime/tree/base64_bytes\"}, {\"url\": \"https://github.com/keylime/rust-keylime\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar from reading database entries created by previous versions, for example, 7.11.0. Specifically, older versions store agent registration data as bytes, whereas the updated registrar expects str. This issue leads to an exception when processing agent registration requests, causing the agent to fail.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-704\", \"description\": \"Incorrect Type Conversion or Cast\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-06-29T23:25:05.421Z\"}, \"x_redhatCweChain\": \"CWE-704: Incorrect Type Conversion or Cast\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-1057\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-29T23:25:05.421Z\", \"dateReserved\": \"2025-02-05T09:57:50.746Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2025-03-15T08:50:48.649Z\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-1057

Vulnerability from fkie_nvd - Published: 2025-03-15 09:15 - Updated: 2026-06-30 00:16

Severity

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	secalert@redhat.com	https://access.redhat.com/security/cve/CVE-2025-1057
	secalert@redhat.com	https://bugzilla.redhat.com/show_bug.cgi?id=2343894
	secalert@redhat.com	https://github.com/ansasaki/keylime/tree/base64_bytes
	secalert@redhat.com	https://github.com/keylime/rust-keylime

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://github.com/keylime/keylime",
          "defaultStatus": "unaffected",
          "packageName": "keylime",
          "versions": [
            {
              "status": "affected",
              "version": "7.12.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keylime",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keylime",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar from reading database entries created by previous versions, for example, 7.11.0. Specifically, older versions store agent registration data as bytes, whereas the updated registrar expects str. This issue leads to an exception when processing agent registration requests, causing the agent to fail."
    },
    {
      "lang": "es",
      "value": "Se detect\u00f3 una falla en Keylime, una soluci\u00f3n de atestaci\u00f3n remota, donde la comprobaci\u00f3n estricta de tipos introducida en la versi\u00f3n 7.12.0 impide que el registrador lea las entradas de la base de datos creadas por versiones anteriores, por ejemplo, la 7.11.0. En concreto, las versiones anteriores almacenan los datos de registro del agente como bytes, mientras que el registrador actualizado espera str. Este problema genera una excepci\u00f3n al procesar las solicitudes de registro del agente, lo que provoca un fallo en el agente."
    }
  ],
  "id": "CVE-2025-1057",
  "lastModified": "2026-06-30T00:16:54.380",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-1057",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-03-17T17:01:10.891516Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-03-15T09:15:10.770",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/security/cve/CVE-2025-1057"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2343894"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://github.com/ansasaki/keylime/tree/base64_bytes"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://github.com/keylime/rust-keylime"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-704"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}

GHSA-9JXQ-5X44-GX23

Vulnerability from github – Published: 2025-02-14 18:03 – Updated: 2026-07-21 14:45

Summary

Keylime registrar is vulnerable to Denial-of-Service attack when updated to version 7.12.0

Details

Impact

The Keylime registrar implemented more strict type checking on version 7.12.0. As a result, when updated to version 7.12.0, the registrar will not accept the format of the data previously stored in the database by versions >= 7.8.0, raising an exception.

This makes the Keylime registrar vulnerable to a Denial-of-Service attack in an update scenario, as an attacker could populate the registrar database by creating multiple valid agent registrations with different UUIDs while the version is still < 7.12.0. Then, when the Keylime registrar is updated to the 7.12.0 version, any query to the database matching any of the entries populated by the attacker will result in failure.

Patches

Users should upgrade to versions >= 7.12.1

Workarounds

Remove the registrar database and re-register all agents

Credit

Reported by: Anderson Toshiyuki Sasaki/@ansasaki Patched by: Anderson Toshiyuki Sasaki/@ansasaki

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "keylime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.12.0"
            },
            {
              "fixed": "7.12.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.12.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-1057"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1287",
      "CWE-704"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-14T18:03:14Z",
    "nvd_published_at": "2025-03-15T09:15:10Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nThe Keylime `registrar` implemented more strict type checking on version 7.12.0. As a result, when updated to version 7.12.0, the `registrar` will not accept the format of the data previously stored in the database by versions  \u003e= 7.8.0, raising an exception.\n\nThis makes the Keylime `registrar` vulnerable to a Denial-of-Service attack in an update scenario, as an attacker could populate the `registrar` database by creating multiple valid agent registrations with different UUIDs while the version is still \u003c 7.12.0. Then, when the Keylime `registrar` is updated to the 7.12.0 version, any query to the database matching any of the entries populated by the attacker will result in failure.\n\n### Patches\nUsers should upgrade to versions \u003e= 7.12.1\n\n### Workarounds\n- Remove the registrar database and re-register all agents\n\n### Credit\n\nReported by: Anderson Toshiyuki Sasaki/@ansasaki\nPatched by: Anderson Toshiyuki Sasaki/@ansasaki",
  "id": "GHSA-9jxq-5x44-gx23",
  "modified": "2026-07-21T14:45:56Z",
  "published": "2025-02-14T18:03:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/keylime/keylime/security/advisories/GHSA-9jxq-5x44-gx23"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1057"
    },
    {
      "type": "WEB",
      "url": "https://github.com/keylime/keylime/commit/e08b10d86c3717006774e787542c190e2ba24fc7"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-1057"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2343894"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-9jxq-5x44-gx23"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ansasaki/keylime/tree/base64_bytes"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/keylime/keylime"
    },
    {
      "type": "WEB",
      "url": "https://github.com/keylime/rust-keylime"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2026-1488.yaml"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/keylime"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Keylime registrar is vulnerable to Denial-of-Service attack when updated to version 7.12.0"
}

OPENSUSE-SU-2025:14813-1

Vulnerability from csaf_opensuse - Published: 2025-02-16 00:00 - Updated: 2025-02-16 00:00

Summary

keylime-config-7.12.1-1.1 on GA media

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2025-1057.

CVE-2025-1057

Recommended: 40 products

Open the full advisory

OPENSUSE-SU-2025:20159-1

Vulnerability from csaf_opensuse - Published: 2025-12-12 09:46 - Updated: 2025-12-12 09:46

Summary

Security update for keylime

Severity

Critical

Scope

2 vulnerabilities in this advisory, including CVE-2025-1057.

CVE-2025-1057

Recommended: 8 products

Open the full advisory

PYSEC-2026-1488

Vulnerability from pysec - Published: 2026-07-07 14:34 - Updated: 2026-07-07 14:34

Details

Impact

Patches

Users should upgrade to versions >= 7.12.1

Workarounds

Remove the registrar database and re-register all agents

Credit

Reported by: Anderson Toshiyuki Sasaki/@ansasaki Patched by: Anderson Toshiyuki Sasaki/@ansasaki

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Impacted products

Name	purl
keylime	pkg:pypi/keylime

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "keylime",
        "purl": "pkg:pypi/keylime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.12.0"
            },
            {
              "fixed": "7.12.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.12.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-1057",
    "GHSA-9jxq-5x44-gx23"
  ],
  "details": "### Impact\nThe Keylime `registrar` implemented more strict type checking on version 7.12.0. As a result, when updated to version 7.12.0, the `registrar` will not accept the format of the data previously stored in the database by versions  \u003e= 7.8.0, raising an exception.\n\nThis makes the Keylime `registrar` vulnerable to a Denial-of-Service attack in an update scenario, as an attacker could populate the `registrar` database by creating multiple valid agent registrations with different UUIDs while the version is still \u003c 7.12.0. Then, when the Keylime `registrar` is updated to the 7.12.0 version, any query to the database matching any of the entries populated by the attacker will result in failure.\n\n### Patches\nUsers should upgrade to versions \u003e= 7.12.1\n\n### Workarounds\n- Remove the registrar database and re-register all agents\n\n### Credit\n\nReported by: Anderson Toshiyuki Sasaki/@ansasaki\nPatched by: Anderson Toshiyuki Sasaki/@ansasaki",
  "id": "PYSEC-2026-1488",
  "modified": "2026-07-07T14:34:49.823034Z",
  "published": "2026-07-07T14:34:49.823034Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/keylime/keylime/security/advisories/GHSA-9jxq-5x44-gx23"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1057"
    },
    {
      "type": "WEB",
      "url": "https://github.com/keylime/keylime/commit/e08b10d86c3717006774e787542c190e2ba24fc7"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-1057"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2343894"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/keylime/keylime"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/keylime"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-9jxq-5x44-gx23"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Keylime registrar is vulnerable to Denial-of-Service attack when updated to version 7.12.0"
}

SUSE-SU-2025:21194-1

Vulnerability from csaf_suse - Published: 2025-12-12 09:45 - Updated: 2025-12-12 09:45

Summary

Security update for keylime

Severity

Critical

Scope

2 vulnerabilities in this advisory, including CVE-2025-1057.

CVE-2025-1057

Recommended: 16 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2025-1057 (GCVE-0-2025-1057)

FKIE_CVE-2025-1057

GHSA-9JXQ-5X44-GX23

Impact

Patches

Workarounds

Credit

OPENSUSE-SU-2025:14813-1

OPENSUSE-SU-2025:20159-1

PYSEC-2026-1488

Impact

Patches

Workarounds

Credit

SUSE-SU-2025:21194-1

Tags

Sightings

Nomenclature