CVE-2023-3674: Fedoraproject Fedora

Low severity, CVSS 2.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

Affected products

• Fedoraproject Fedora: version 38 only
• Keylime Keylime: before 7.2.5 (fixed in 7.2.5)

Published 2023-07-19. Last modified 2026-06-17.