CVE-2023-3674

LowCVSS 2.8/10Last modified Jun 17, 2026

Description

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

Metrics

CVSS 3.1 2.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-1283

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 9	—

References

https://access.redhat.com/errata/RHSA-2024:1139
https://access.redhat.com/security/cve/CVE-2023-3674Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2222903Issue Tracking, Patch, Third Party Advisory
https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733dbPatch
https://access.redhat.com/errata/RHSA-2024:1139
https://access.redhat.com/security/cve/CVE-2023-3674Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2222903Issue Tracking, Patch, Third Party Advisory
https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733dbPatch

Timeline

Published: Jul 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-367407.83D Viewer Remote Code Execution Vulnerability CVE-2023-367417.5Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability CVE-2023-367427.8Visual Studio Code Remote Code Execution Vulnerability CVE-2023-367437.8Win32k Elevation of Privilege Vulnerability CVE-2023-367448.0Microsoft Exchange Server Remote Code Execution Vulnerability CVE-2023-367458.0Microsoft Exchange Server Remote Code Execution Vulnerability CVE-2023-367467.8Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 fstWritex len functionality of GTKWave 3.3.115. A spec CVE-2023-367477.8Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 fstWritex len functionality of GTKWave 3.3.115. A spec CVE-2023-367486.8A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGE CVE-2023-367497.4A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGE CVE-2023-36756.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Secomea GateManager (Web GUI) allows Reading CVE-2023-367507.2A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGE