Vulnerability in keylime (CVE-2025-1057)
Summary
Vulnerability in keylime (CVE-2025-1057). Risk of unauthorized operations or information disclosure. Exploitable via registrar. Mitigation: upgrade to 7.12.1 or later.
Original description
The description as published by the source.
Impact
The Keylime registrar implemented more strict type checking on version 7.12.0. As a result, when updated to version 7.12.0, the registrar will not accept the format of the data previously stored in the database by versions >= 7.8.0, raising an exception.
This makes the Keylime registrar vulnerable to a Denial-of-Service attack in an update scenario, as an attacker could populate the registrar database by creating multiple valid agent registrations with different UUIDs while the version is still < 7.12.0. Then, when the Keylime registrar is updated to the 7.12.0 version, any query to the database matching any of the entries populated by the attacker will result in failure.
Patches
Users should upgrade to versions >= 7.12.1
Workarounds
- Remove the registrar database and re-register all agents
Credit
Reported by: Anderson Toshiyuki Sasaki/@ansasaki
Patched by: Anderson Toshiyuki Sasaki/@ansasaki
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2025-1057 has been found in keylime.
Attackers can target a specific entry point like registrar over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 4.3/10.
What to do: upgrade keylime to 7.12.1 or later.
If unsure, ask your IT team or search "keylime CVE-2025-1057" on the vendor's site.
CVE-2025-1057 (keylime) — CWE-1287 / CVSS v3 4.3
Attack vector: remote (network-reachable) / unauthenticated
Attack surface: registrar
Patched: 7.12.1 — apply immediately
Workaround: - Remove the registrar database and re-register all agents
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-1287) exists in keylime. Attackers reach the vulnerable code path via registrar without authentication.
Check the vendor advisory for the affected versions of keylime. Attack surface: registrar.
Severity: Medium (CVSS 4.3/10). Risk of unauthorized operations or information disclosure.
Update to 7.12.1.
Workaround: - Remove the registrar database and re-register all agents
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'keylime' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'keylime' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
keylimeを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
- Remove the registrar database and re-register all agentsパッチが適用されるまでの応急処置として、- Remove the registrar database and re-register all agents を実施。回避策の副作用 (機能低下) を確認した上で。
-
3Apply patch patch
Upgrade keylime to 7.12.1ステージング環境で 7.12.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web access.redhat.com
- web bugzilla.redhat.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web pypi.org