CVE-2021-3406
CRITICALCVSS 9.8/10EPSS 0.66%
Last modified
CVE-2021-3406 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations.. EPSS estimates a 0.66% chance of exploitation in the next 30 days.
Description
A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Keylime | Keylime | <= 5.8.1 |
| Fedoraproject | Fedora | 34 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1932469Issue Tracking, Third Party Advisory
- https://github.com/keylime/keylime/security/advisories/GHSA-78f8-6c68-375mThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1932469Issue Tracking, Third Party Advisory
- https://github.com/keylime/keylime/security/advisories/GHSA-78f8-6c68-375mThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-3406?
A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations.
How severe is CVE-2021-3406?
CVE-2021-3406 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 0.66% probability of exploitation in the next 30 days.
How do I fix CVE-2021-3406?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-3401Bitcoin Core before 0.19.0 might allow remote attackers to e…9.8
- CVE-2021-3402An integer overflow and several buffer overflow reads in lib…9.1
- CVE-2021-3403In ytnef 1.9.3, the TNEFSubjectHandler function in lib/ytnef…7.8
- CVE-2021-3404In ytnef 1.9.3, the SwapWord function in lib/ytnef.c allows …7.8
- CVE-2021-3405A flaw was found in libebml before 1.4.2. A heap overflow bu…6.5
- CVE-2021-34055jhead 3.06 is vulnerable to Buffer Overflow via exif.c in fu…7.8
- CVE-2021-34064Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2021-34066An issue was discovered in EdgeGallery/developer before v1.0…9.8
- CVE-2021-34067Heap based buffer overflow in tsMuxer 2.6.16 allows attacker…5.5
- CVE-2021-34068Heap based buffer overflow in tsMuxer 2.6.16 allows attacker…5.5
- CVE-2021-34069Divide-by-zero bug in tsMuxer 2.6.16 allows attackers to cau…5.5
- CVE-2021-3407A flaw was found in mupdf 1.18.0. Double free of object duri…5.5
Are you affected by CVE-2021-3406?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST