Keylime's registrar vulnerable to Denial-of-service attack via a single open connection
Date: 2023-08
Affected: pip/keylime
Attack vector: dos
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2023-38200
CWE: CWE-834
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

### Impact Keylime `registrar` is prone to a simple denial of service attack in which an adversary opens a connection to the TLS port (by default, port `8891`) blocking further, legitimate connections. As long as the connection is open, the `registrar` is blocked and cannot serve any further clients (`agents` and `tenants`), which prevents normal operation. The problem does not affect the `verifier`. ### Patches Users should upgrade to release 7.4.0


Mitigations:

Architectural layers (MAESTRO):