GHSA-xh5w-g8gq-r3v9
Keylime allows users to register new agents by recycling existing UUIDs when using different TPM devices
At a glance
- Published
- Updated
- CVE
- CVE-2025-13609
- Aliases
- PYSEC-2025-77
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L
Description
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.
Affected packages
| Package | Versions |
|---|---|
| PyPI · keylime | introduced 0, fixed 7.13.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-13609 ADVISORY
- https://github.com/keylime/keylime/issues/1820 WEB
- https://github.com/keylime/keylime/pull/1785 WEB
- https://github.com/keylime/keylime/commit/e1ae8de1f7b1385eaeec66572a92ff1338e6e157 WEB
- https://access.redhat.com/errata/RHSA-2025:23201 WEB
- https://access.redhat.com/errata/RHSA-2025:23210 WEB
- https://access.redhat.com/errata/RHSA-2025:23628 WEB
- https://access.redhat.com/errata/RHSA-2025:23735 WEB
- https://access.redhat.com/errata/RHSA-2025:23852 WEB
- https://access.redhat.com/errata/RHSA-2026:0429 WEB
- https://access.redhat.com/security/cve/CVE-2025-13609 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2416761 WEB
- https://github.com/keylime/keylime PACKAGE
- https://github.com/keylime/keylime/releases/tag/v7.13.0 WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2025-77.yaml WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |