CVE-2023-38200
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
A flaw was found in Keylime that allows for a remote denial of service attack against its SSL connections. An attacker can exhaust all available connections.
Risk Assessment
This vulnerability may lead to service unavailability, impacting the organization's operational continuity and potentially causing financial losses.
Recommendation
It is recommended to monitor SSL connections and implement mechanisms to limit the number of simultaneous connections to the Keylime registrar.
Other vulnerabilities in Keylime
See all- CVE-2026-1709Critical
A flaw was found in Keylime since version 7.12.0 where the registrar does not enforce client-side TLS authentication. Unauthenticated clients with network access can perform administrative operations, including listing agents, retrieving public TPM data, and deleting agents, without presenting a client certificate.
- CVE-2025-13609High
A vulnerability in Keylime allows an attacker to register a new agent using a different TPM device but claiming an existing agent's UUID. This overwrites the legitimate agent's identity and enables impersonation.
- CVE-2025-1057Medium
In Keylime 7.12.0, strict type checking prevents the registrar from reading database entries created by older versions (e.g., 7.11.0). Older versions store agent registration data as bytes, while the updated registrar expects str. This causes an exception when processing agent registration requests, making the agent fail.
Original NVD description (English source)
A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.