Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Keylime Registrar Can Be Shut Down by Single Open Connection
published 3 years ago
Summary
Keylime's registrar can be taken offline by an attacker who opens a single connection and continues to hold onto it. This can happen remotely, and it's a serious issue because it can prevent anyone from using the registrar. To stay safe, update Keylime to the latest version to fix this issue.
What to do
- Update keylime community keylime to version 7.4.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | keylime community | keylime |
< 7.4.0 Fix: upgrade to 7.4.0
|
Original advisory text
Duplicate Advisory: Keylime's registrar vulnerable to Denial-of-service attack via a single open connection
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-pg75-v6fp-8q59. This link is maintained to preserve external references.
## Original Description
A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.
This advisory has been withdrawn because it is a duplicate of GHSA-pg75-v6fp-8q59. This link is maintained to preserve external references.
## Original Description
A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published24 Jul 2023
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-9gjg-834p-5gvv · GHSA
Track software like this
Free during beta