Bug 2222692 (CVE-2023-38200)

Summary:	CVE-2023-38200 keylime: registrar is subject to a DoS against SSL connections
Product:	[Other] Security Response	Reporter:	Zack Miele <zmiele>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ansasaki, dueno, ksrot, pkoncity, scorreia, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	keylime 7.5.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2222694, 2222841, 2228048
Bug Blocks:	2222691

Description Zack Miele 2023-07-13 13:24:53 UTC

The Keylime Registrar is subject to a DoS attack against it's SSL connections because they are blocking and a fairly simple attack could exhaust all of the available connections.

References:

https://github.com/keylime/keylime/pull/1421

Comment 2 TEJ RATHI 2023-07-14 05:31:01 UTC

Created keylime tracking bugs for this issue:

Affects: fedora-all [bug 2222841]

Comment 3 errata-xmlrpc 2023-09-12 10:10:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:5080 https://access.redhat.com/errata/RHSA-2023:5080