CVE-2022-23951

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In Keylime before 6.3.0, quote responses from the agent can contain possibly untrusted ZIP data which can lead to zip bombs.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	keylime	keylime 6.3.0

References

https://github.com/keylime/keylime/commit/6e44758b64b0ee13564fc46e807f4ba98091c355Patch, Third Party Advisory
https://github.com/keylime/keylime/security/advisories/GHSA-6xx7-m45w-76m2Third Party Advisory
https://seclists.org/oss-sec/2022/q1/101Exploit, Mailing List, Patch, Third Party Advisory
https://github.com/keylime/keylime/commit/6e44758b64b0ee13564fc46e807f4ba98091c355Patch, Third Party Advisory
https://github.com/keylime/keylime/security/advisories/GHSA-6xx7-m45w-76m2Third Party Advisory
https://seclists.org/oss-sec/2022/q1/101Exploit, Mailing List, Patch, Third Party Advisory

Timeline

Published: Sep 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-239527.5In Keylime before 6.3.0, current keylime installer installs the keylime.conf file, which can contain sensitive data, as world-readable.CVE-2022-239535.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239545.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239555.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239565.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239575.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239585.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239599.1In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x befor CVE-2022-23965.4A vulnerability classified as problematic was found in SourceCodester Simple e-Learning System 1.0. Affected by this vulnerability is an unk CVE-2022-239605.6Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can l CVE-2022-239616.1In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited by CVE-2022-239687.5Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF fil