CVE-2022-1053: keylime - Tenant and Verifier Data Mismatch
Summary
CVE-2022-1053: Tenant and Verifier might not use the same registrar data. Affects keylime versions < 6.4.0. Fixed in 6.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keylime is an open-source project available on PyPI that provides a trusted cloud infrastructure for secure bootstrapping, integrity measurement, and attestation of virtual machines. It utilizes the Trusted Platform Module (TPM) technology to establish a chain of trust. The vulnerability identified as CVE-2022-1053 in the keylime package allows an attacker to exploit a mismatch in the agent registrar data used by the tenant and verifier components. This mismatch can lead to the use of an unvalidated Attestation Key (AK) by the verifier, compromising the entire chain of trust.
Vulnerability Detail
The vulnerability arises from the lack of enforcement in Keylime to ensure that the agent registrar data used by the tenant and verifier components is the same. This allows an attacker to present a valid Endorsement Key (EK) and identity quote to the tenant, while providing the verifier with an AK from a software TPM. By bypassing the EK validation, the attacker can introduce an unvalidated AK into the chain of trust. The impact of a successful attack is severe, as it breaks the integrity and trustworthiness of the entire system. This vulnerability is particularly critical if the agent is added to the verifier after the validation process, as the verifier does not validate the regcount entry being equal to 1.
How To Fix
Latest published version: 7.14.3 as of 22 Oct 2026
pip install --upgrade "keylime==7.14.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.4.0
This is the first release that contains the fix.
pip install --upgrade "keylime==6.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At this time, there are no known workarounds for this vulnerability.
Conclusion
The vulnerability identified as CVE-2022-1053 in the keylime package poses a critical risk to the integrity and trustworthiness of the system. It allows an attacker to bypass validation and introduce an unvalidated Attestation Key (AK) into the chain of trust. To mitigate this vulnerability, it is crucial to update the keylime package to version 6.4.0 or later. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for keylime →
FAQ
Keylime is an open-source project that provides a trusted cloud infrastructure for secure bootstrapping, integrity measurement, and attestation of virtual machines using TPM technology.
The vulnerability allows an attacker to introduce an unvalidated Attestation Key (AK) into the chain of trust, compromising the integrity and trustworthiness of the entire system.
To fix this vulnerability, update the keylime package to version 6.4.0 or later by running the command 'pip install --upgrade keylime'.
No, there are currently no known workarounds for this vulnerability.
For more information about this vulnerability, you can refer to the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-jf66-3q76-h5p5/GHSA-jf66-3q76-h5p5.json
References
Related vulnerabilities
Recent vulnerabilities recorded for keylime.
