CVE-2023-3674: keylime - Failure to Flag Device as Untrusted
Summary
CVE-2023-3674: keylime fails to flag device as untrusted when signature does not validate. Affects keylime versions < 7.2.5. Fixed in 7.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keylime is a Python package available on PyPI that provides trusted bootstrapping and remote attestation for virtual machines. It is primarily used in cloud environments to ensure the integrity of virtual machine instances. Keylime relies on the Trusted Platform Module (TPM) to generate and verify cryptographic signatures for attestation quotes. This vulnerability in keylime allows a device's submitted TPM quote to be accepted as valid even when the quote's signature does not validate. This flaw can lead to the acceptance of untrusted devices, compromising the security of the system.
Vulnerability Detail
The keylime attestation verifier fails to flag a device as untrusted when the signature of the TPM quote does not validate. Instead of properly identifying the faulty quote, it only emits an error in the log without taking any action to mark the device as untrusted. This vulnerability allows an attacker to bypass the attestation process and gain access to the system using a compromised device. The impact of this vulnerability is a potential compromise of the system's security and integrity.
How To Fix
Latest published version: 7.14.3 as of 22 Oct 2026
pip install --upgrade "keylime==7.14.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.2.5
This is the first release that contains the fix.
pip install --upgrade "keylime==7.2.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the keylime package to the fixed version to mitigate the risk.
Conclusion
The keylime package is vulnerable to a flaw that allows devices with faulty TPM quotes to be accepted as valid. This can lead to the compromise of system security. It is crucial to update the keylime package to version 7.2.5 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keylime →
FAQ
Keylime is a Python package that provides trusted bootstrapping and remote attestation for virtual machines in cloud environments.
This vulnerability allows an attacker to bypass the attestation process and gain access to the system using a compromised device, compromising the system's security and integrity.
To fix this vulnerability, update the keylime package to version 7.2.5 or later.
No, there is no known workaround. Updating the keylime package is the recommended solution.
For more information, you can visit the Vulert Playground at Vulert Scanner
Related vulnerabilities
Recent vulnerabilities recorded for keylime.
