CVE-2025-1057
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
In Keylime 7.12.0, strict type checking prevents the registrar from reading database entries created by older versions (e.g., 7.11.0). Older versions store agent registration data as bytes, while the updated registrar expects str. This causes an exception when processing agent registration requests, making the agent fail.
Risk Assessment
The organization may face issues adding new agents to the Keylime infrastructure after upgrading to version 7.12.0, potentially disrupting remote attestation and system integrity monitoring.
Recommendation
Upgrade Keylime to a version that fixes this issue, or temporarily revert the update to version 7.12.0 and stay on version 7.11.0 until a patch is released.
Other vulnerabilities in Keylime
See all- CVE-2026-1709Critical
A flaw was found in Keylime since version 7.12.0 where the registrar does not enforce client-side TLS authentication. Unauthenticated clients with network access can perform administrative operations, including listing agents, retrieving public TPM data, and deleting agents, without presenting a client certificate.
- CVE-2025-13609High
A vulnerability in Keylime allows an attacker to register a new agent using a different TPM device but claiming an existing agent's UUID. This overwrites the legitimate agent's identity and enables impersonation.
- CVE-2023-38200High
A flaw was found in Keylime that allows for a remote denial of service attack against its SSL connections. An attacker can exhaust all available connections.
Original NVD description (English source)
A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar from reading database entries created by previous versions, for example, 7.11.0. Specifically, older versions store agent registration data as bytes, whereas the updated registrar expects str. This issue leads to an exception when processing agent registration requests, causing the agent to fail.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS