title: Keylime: attestation failure when the quote's signature does not validate
description: A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.
problem types: Mutable Attestation or Measurement Reporting Data
affected:
{
product: keylime
vendor: n/a
versions:
version: 7.2.5, status: unaffected
version: 7.3.0, status: unaffected
}
{
product: keylime
vendor: n/a
defaultStatus: affected
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: keylime
defaultStatus: affected
cpes: cpe:/o:redhat:enterprise_linux:9
}
{
product: Fedora
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: keylime
defaultStatus: affected
}
metrics:
other: [
content: {'value': 'Low', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]