high8.8
CVE-2023-43635
EVE Seals Vault Key With SHA1 PCRs
Impact
### Impact The vault key is sealed using SHA1 PCRs instead of SHA256 PCRs Thus an attacker with physical access to an EVE-OS device can try to brute force creating a kernel or rootfs image which produces the same SHA1 PCR but with malicious content. ### Patches Fixed in 9.4.3-lts and 10.1.0 ### Workarounds None
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/lf-edge/eve | < 0.0.0-20230519072751-977f42b07fa9 | 0.0.0-20230519072751-977f42b07fa9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linuxfoundation | Edge Virtualization Engine | before 9.5.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://asrg.io/security-advisories/cve-2023-43635/
- https://github.com/advisories/GHSA-4jvr-vj2c-8q37
- https://github.com/lf-edge/eve/security/advisories/GHSA-4jvr-vj2c-8q37
- https://nvd.nist.gov/vuln/detail/CVE-2023-43635
- https://asrg.io/security-advisories/cve-2023-43635
- https://asrg.io/security-advisories/vault-key-sealed-with-sha1-pcrs