CVE-2023-38201: fedoraproject fedora

Vulnerability summary

CVE-2023-38201 is a medium (CVSS 6.5) vulnerability in fedoraproject fedora. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 41.1% of scored vulnerabilities.

Timeline

1. 25-08-2023
   PublishedVulnerability first disclosed.
2. 20-11-2025
   Last modifiedVulnerability information updated.

Description

A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.