CVE-2023-38201: Keylime: challenge-response protocol bypass during agent registration

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• fedoraproject fedora38
• keylime keylimebefore 7.5.0
• redhat enterprise linux9.0
• redhat enterprise linux eus9.2
• redhat enterprise linux for ibm z systems9.0_s390x
• redhat enterprise linux for ibm z systems eus9.2_s390x
• redhat enterprise linux for power little endian9.0_ppc64le
• redhat enterprise linux for power little endian eus9.2_ppc64le
• redhat enterprise linux server aus9.2

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• Red Hat Red Hat Enterprise Linux 9

  • 0:6.5.2-6.el9_2 and laternot affected · rpm

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-1709Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication
  41Plan
• CVE-2021-43310A vulnerability in Keylime before 6.3.0 allows an attacker to craft a request to the agent that resets the U and V keys as if the agent were
  40Plan
• CVE-2021-3406A flaw was found in keylime 5.8.1 and older.
  39Monitor

Published before and after this one in the same product

• ← EarlierCVE-2022-3500Nov 22, 2022 · A vulnerability was found in keylime.
  20Monitor
• ← EarlierCVE-2023-3674Jul 19, 2023 · Keylime: attestation failure when the quote's signature does not validate
  11Monitor
• ← EarlierCVE-2023-38200Jul 24, 2023 · Keylime: registrar is subject to a dos against ssl connections
  30Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The endpoint fetches the record by the ID sent in the request, but never checks whether the record belongs to the requesting user.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const invoice = await Invoice.findById(req.params.id);2res.json(invoice);

1const invoice = await Invoice.findOne({2  id: req.params.id,3  ownerId: req.user.id,4});5if (!invoice) return res.sendStatus(404);6res.json(invoice);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.