CVE-2021-43310 Auth bypass in keylime

What is CVE-2021-43310?

CVE-2021-43310 is a critical authentication bypass vulnerability in keylime, published on 21 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in Keylime before 6.3.0 allows an attacker to craft a request to the agent that resets the U and V keys as if the agent were being re-added to a verifier. This could lead to a remote code execution.

Weakness: CWE-290

Which versions are affected by CVE-2021-43310?

It affects 1 product.

Products include Keylime Keylime.

How do I fix CVE-2021-43310?

No fix has been published for CVE-2021-43310 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2021-43310 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-43310 exists.

Other vulnerabilities in keylime

• CVE-2026-1709 Keylime Missing Authentication for Critical Function and Improper Authentication Critical 9.4
• CVE-2022-23948 Information disclosure in keylime High 7.5
• CVE-2022-23949 Other in keylime High 7.5
• CVE-2022-23950 Denial of service in keylime High 7.5
• CVE-2022-23952 Information disclosure in keylime High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2m39-75g9-ff5r.