{"answers":{"affected":"3 open source packages ship an affected version, including github.com/lf-edge/eve. It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-43635 in the wild and no public exploit code.","fix":"Upgrade github.com/lf-edge/eve to 0.0.0-20230519072751-977f42b07fa9 or later.","what":"CVE-2023-43635 is a high-severity vulnerability in EVE OS, published on 20 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-43635 and fix it if it is affected.\n\nWhat it is: CVE-2023-43635 is a high-severity vulnerability in EVE OS, published on 20 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-43635 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/lf-edge/eve (Go): affected all versions; fixed in 0.0.0-20230519072751-977f42b07fa9\n- github.com/lf-edge/eve (Go): affected all versions; fixed in 0.0.0-20230519072751-977f42b07fa9\n- github.com/lf-edge/eve (Go): affected all versions; fixed in 0.0.0-20230519072751-977f42b07fa9\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-43635/ (Markdown: https://insights.sbomify.com/CVE-2023-43635/index.md)","id":"CVE-2023-43635","markdown":"https://insights.sbomify.com/CVE-2023-43635/index.md","name":"CVE-2023-43635","record":{"aliases":["GHSA-4jvr-vj2c-8q37","GO-2026-4434"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["data_read","security_bypass"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"EVE OS","requires_auth":"low_privilege","summary":"Attackers can bypass measured boot protections and read sensitive vault data because the TPM key is sealed with insecure SHA1 PCRs instead of SHA256.","user_interaction":"not_required","vuln_class":"weak_cryptography"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"ASRG","cpe":[{"product":"edge_virtualization_engine","vendor":"linuxfoundation"}],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-327","name":"Use of a Broken or Risky Cryptographic Algorithm"},{"id":"CWE-522","name":"Insufficiently Protected Credentials"},{"id":"CWE-328","name":"Use of Weak Hash"}],"description":"Vault Key Sealed With SHA1 PCRs\n\nThe measured boot solution implemented in EVE OS leans on a PCR locking mechanism.\n\nDifferent parts of the system update different PCR values in the TPM, resulting in a unique\nvalue for each PCR entry.\n\nThese PCRs are then used in order to seal/unseal a key from the TPM which is used to\nencrypt/decrypt the “vault” directory.\n\nThis “vault” directory is the most sensitive point in the system and as such, its content should\nbe protected.\n\nThis mechanism is noted in Zededa’s documentation as the “measured boot” mechanism,\ndesigned to protect said “vault”.\n\nThe code that’s responsible for generating and fetching the key from the TPM assumes that\nSHA256 PCRs are used in order to seal/unseal the key, and as such their presence is being\nchecked.\n\nThe issue here is that the key is not sealed using SHA256 PCRs, but using SHA1 PCRs.\nThis leads to several issues:\n\n• Machines that have their SHA256 PCRs enabled but SHA1 PCRs disabled, as well\nas not sealing their keys at all, meaning the “vault” is not protected from an attacker.\n\n• SHA1 is considered insecure and reduces the complexity level required to unseal the\nkey in machines which have their SHA1 PCRs enabled.\n\nAn attacker can very easily retrieve the contents of the “vault”, which will effectively render\nthe “measured boot” mechanism meaningless.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Vault Key Sealed With SHA1 PCRs","id":"CVE-2023-43635","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"weak_cryptography","year":"2023"},"n_packages":3,"n_references":1,"next":{"headline":"Rootfs Not Protected","id":"CVE-2023-43636"},"packages":[{"ecosystem":"Go","fixed":["0.0.0-20230519072751-977f42b07fa9"],"introduced":["0"],"last_affected":[],"package":"github.com/lf-edge/eve","purl":null,"source":"GHSA-4jvr-vj2c-8q37"},{"ecosystem":"Go","fixed":["0.0.0-20230519072751-977f42b07fa9"],"introduced":["0"],"last_affected":[],"package":"github.com/lf-edge/eve","purl":"pkg:golang/github.com/lf-edge/eve","source":"GHSA-4jvr-vj2c-8q37"},{"ecosystem":"Go","fixed":["0.0.0-20230519072751-977f42b07fa9"],"introduced":["0"],"last_affected":[],"package":"github.com/lf-edge/eve","purl":"pkg:golang/github.com/lf-edge/eve","source":"GO-2026-4434"}],"prev":{"headline":"Config Partition Not Protected by Measured Boot","id":"CVE-2023-43634"},"products":["EVE OS"],"published":"2023-09-20","related":[{"cvss_score":9,"headline":"Freely Allocate Buffer on The Stack With Data From Socket","id":"CVE-2023-43632","kev_date_added":null,"published":"2023-09-21"},{"cvss_score":8.8,"headline":"SSH as Root Unlockable Without Triggering Measured Boot","id":"CVE-2023-43631","kev_date_added":null,"published":"2023-09-21"},{"cvss_score":8.8,"headline":"Config Partition Not Measured From 2 Fronts","id":"CVE-2023-43630","kev_date_added":null,"published":"2023-09-20"},{"cvss_score":8.8,"headline":"Rootfs Not Protected","id":"CVE-2023-43636","kev_date_added":null,"published":"2023-09-20"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2024-09-25","vendors":[" LF-Edge, Zededa"]},"summary":"Attackers can bypass measured boot protections and read sensitive vault data because the TPM key is sealed with insecure SHA1 PCRs instead of SHA256.","url":"https://insights.sbomify.com/CVE-2023-43635/"}