A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0217-1 advisory.

    - CVE-2025-13609: avoid re-registration of clients with same UUID but with different TPM identity     (bsc#1254199).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0429 advisory.

    Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

    Security Fix(es):

    * keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-11565:05 advisory.

    * keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:23201 advisory.

    * keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:23735 advisory.

    Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

    Security Fix(es):

    * keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:23852 advisory.

    Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

    Security Fix(es):

    * keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:23628 advisory.

    Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

    Security Fix(es):

    * keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:23201 advisory.

    * keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:23210 advisory.

    * keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-23201 advisory.

    [7.12.1-15]
    - Registrar allows identity takeover via duplicate UUID registration

    [7.12.1-14]
    - Properly fix malformed TPM certificates workaround

    [7.12.1-13]
    - Avoid opening /dev/stdout when printing

    [7.12.1-12]
    - Fix malformed TPM certificates workaround

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:23210 advisory.

    * keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-23210 advisory.

    [7.12.1-11.3]
    - Registrar allows identity takeover via duplicate UUID registration       Resolves: RHEL-130760

    [7.12.1-11.2]
    - Properly fix the malformed certificate workaround       Resolves: RHEL-111244

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:23210 advisory.

    Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

    Security Fix(es):

    * keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:21194-1 advisory.

    Update to version 7.13.0+40.

    Security issues fixed:

    - CVE-2025-13609: possible agent identity takeover due to registrar allowing the registration of agents     with duplicate       UUIDs (bsc#1254199).
    - CVE-2025-1057: registrar denial-of-service due to backward incompatibility in database type handling     (bsc#1237153).

    Other issues fixed and changes:

    - Version 7.13.0+40:
      * Include new attestation information fields (#1818)
      * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
      * push-model: require HTTPS for authentication and attestation endpoints
      * Fix operational_state tracking in push mode attestations
      * templates: add push model authentication config options to 2.5 templates
      * Security: Hash authentication tokens in logs
      * Fix stale IMA policy cache in verification
      * Fix authentication behavior on failed attestations for push mode
      * Add shared memory infrastructure for multiprocess communication
      * Add agent authentication (challenge/response) protocol for push mode
      * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
      * docs: Fix man page RST formatting for rst2man compatibility (#1813)
      * Apply limit on keylime-policy workers
      * tpm: fix ECC signature parsing to support variable-length coordinates
      * tpm: fix ECC P-521 credential activation with consistent marshaling
      * tpm: fix ECC P-521 coordinate validation
      * Remove deprecated disabled_signing_algorithms configuration option (#1804)
      * algorithms: add support for specific RSA algorithms
      * algorithms: add support for specific ECC curve algorithms
      * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
      * Manpage for keylime agent
      * Manpage for keylime verifier
      * Manpage for keylime registrar
      * Use constants for timeout and max retries defaults
      * verifier: Use timeout from `request_timeout` config option
      * revocation_notifier: Use timeout setting from config file
      * tenant: Set timeout when getting version from agent
      * verify/evidence: SEV-SNP evidence type/verifier
      * verify/evidence: Add evidence type to request JSON

    - Version v7.13.0:
      * Avoid re-encoding certificate stored in DB
      * Revert models: Do not re-encode certificate stored in DB
      * Revert registrar_agent: Use pyasn1 to parse PEM
      * policy/sign: use print() when writing to /dev/stdout
      * registrar_agent: Use pyasn1 to parse PEM
      * models: Do not re-encode certificate stored in DB
      * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
      * mb: support vendor_db as logged by newer shim versions
      * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
      * Remove unnecessary configuration values
      * cloud_verifier_tornado: handle exception in notify_error()
      * requests_client: close the session at the end of the resource manager
      * Manpage for keylime_tenant (#1786)
      * Add 2.5 templates including Push Model changes
      * Initial version of verify evidence API
      * db: Do not read pool size and max overflow for sqlite
      * Use context managers to close DB sessions
      * revocations: Try to send notifications on shutdown
      * verifier: Gracefully shutdown on signal
      * Use `fork` as `multiprocessing` start method
      * Fix inaccuracy in threat model and add reference to SBAT
      * Explain TPM properties and expand vTPM discussion
      * Fix invalid RST and update TOC
      * Expand threat model page to include adversarial model
      * Add --push-model option to avoid requests to agents
      * templates: duplicate str_to_version() in the adjust script
      * policy: fix mypy issues with rpm_repo
      * revocation_notifier: fix mypy issue by replacing deprecated call
      * Fix create_runtime_policy in python < 3.12
      * Fix after review
      * fixed CONSTANT names C0103 errors
      * Extend meta_data field in verifierdb
      * docs: update issue templates
      * docs: add GitHub PR template with documentation reminders
      * tpm_util: fix quote signature extraction for ECDSA
      * registrar: Log API versions during startup
      * Remove excessive logging on exception
      * scripts: Fix coverage information downloading script

    - Version v7.12.1:
      * models: Add Base64Bytes type to read and write from the database
      * Simplify response check from registrar

    - Version v7.12.0:
      * API: Add /version endpoint to registrar
      * scripts: Download coverage data directly from Testing Farm
      * docs: Add separate documentation for each API version
      * scripts/create_runtime_policy.sh: fix path for the exclude list
      * docs: add documentation for keylime-policy
      * templates: Add the new agent.conf option 'api_versions'
      * Enable autocompletion using argcomplete
      * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
      * Configure EPEL-10 repo in packit-ci.fmf
      * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
      * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
      * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
      * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
      * keylime-policy: improve error handling when provided a bad key (sign)
      * keylime-policy: exit with status 1 when the commands failed
      * keylime-policy: use Certificate() from models.base to validate certs
      * keylime-policy: check for valid cert file when using x509 backend (sign)
      * keylime-policy: fix help for keylime-policy sign verb
      * tenant: Correctly log number of tries when deleting
      * update TCTI environment variable usage
      * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
      * keylime-policy: add `create measured-boot' subcommand
      * keylime-policy: add `sign runtime' subcommand
      * keylime-policy: add logger to use with the policy tool
      * installer.sh: Restore execution permission
      * installer: Fix string comparison
      * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
      * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
      * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
      * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
      * installer.sh: updated EPEL, PEP668 Fix, logic fix
      * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
      * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
      * postgresql support for docker using psycopg2
      * installer.sh: update package list, add workaround for PEP 668
      * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
      * keylime.conf: full removal
      * Drop pending SPDX-License-Identifier headers
      * create_runtime_policy: Validate algorithm from IMA measurement log
      * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
      * create_runtime_policy: drop commment with test data
      * create_runtime_policy: Use a common method to guess algorithm
      * keylime-policy: rename tool to keylime-policy instead of keylime_policy
      * keylime_policy: create runtime: remove --use-ima-measurement-list
      * keylime_policy: use consistent arg names for create_runtime_policy
      * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
      * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
      * elchecking/example: workaround empty PK, KEK, db and dbx
      * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
      * create_runtime_policy: Fix log level for debug messages
      * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
      * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
      * pylintrc: Ignore too-many-positional-arguments check
      * keylime/web/base/controller: Move TypeAlias definition out of class
      * create_runtime_policy: Calculate digests in multiple threads
      * create_runtime_policy: Allow rootfs to be in any directory
      * keylime_policy: Calculate digests from each source separately
      * create_runtime_policy: Simplify boot_aggregate parsing
      * ima: Validate JSON when loading IMA Keyring from string
      * docs: include IDevID page also in the sidebar
      * docs: point to installation guide from RHEL and SLE Micro
      * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
      * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
      * change check_tpm_origin_check to a warning that does not prevent registration
      * docs: Fix Runtime Policy JSON schema to reflect the reality
      * Sets absolute path for files inside a rootfs dir
      * policy/create_runtime_policy: fix handling of empty lines in exclude list
      * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
      * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
      * codestyle: convert bytearrays to bytes to get expected type (pyright)
      * codestyle: Use new variables after changing datatype (pyright)
      * cert_utils: add description why loading using cryptography might fail
      * ima: list names of the runtime policies
      * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
      * tox: Use python 3.10 instead of 3.6
      * revocation_notifier: Use web_util to generate TLS context
      * mba: Add a skip custom policies option when loading mba.
      * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
      * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
      * cmd/keylime_policy: add tool to handle keylime policies
      * cert_utils: add is_x509_cert()
      * common/algorithms: transform Encrypt and Sign class into enums
      * common/algorithms: add method to calculate digest of a file
      * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
      * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
      * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
      * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
      * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
      * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
      * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
      * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
      * tpm: Replace KDFs and ECDH implementations with python-cryptography
      * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
      * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
      * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
      * build(deps): bump actions/first-interaction
      * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
      * revocation_notifier: Explicitly add CA certificate bundle
      * Introduce new REST API framework and refactor registrar implementation
      * mba: Support named measured boot policies
      * tenant: add friendlier error message if mTLS CA is wrongly configured
      * ca_impl_openssl: Mark extensions as critical following RFC 5280
      * Include Authority Key Identifier in KL-generated certs
      * verifier, tenant: make payload for agent completely optional

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:23201 advisory.

    Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

    Security Fix(es):

    * keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:20159-1 advisory.

    Update to version 7.13.0+40.

    Security issues fixed:

    - CVE-2025-13609: possible agent identity takeover due to registrar allowing the registration of agents     with duplicate       UUIDs (bsc#1254199).
    - CVE-2025-1057: registrar denial-of-service due to backward incompatibility in database type handling     (bsc#1237153).

    Other issues fixed and changes:

    - Version 7.13.0+40:
      * Include new attestation information fields (#1818)
      * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
      * push-model: require HTTPS for authentication and attestation endpoints
      * Fix operational_state tracking in push mode attestations
      * templates: add push model authentication config options to 2.5 templates
      * Security: Hash authentication tokens in logs
      * Fix stale IMA policy cache in verification
      * Fix authentication behavior on failed attestations for push mode
      * Add shared memory infrastructure for multiprocess communication
      * Add agent authentication (challenge/response) protocol for push mode
      * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
      * docs: Fix man page RST formatting for rst2man compatibility (#1813)
      * Apply limit on keylime-policy workers
      * tpm: fix ECC signature parsing to support variable-length coordinates
      * tpm: fix ECC P-521 credential activation with consistent marshaling
      * tpm: fix ECC P-521 coordinate validation
      * Remove deprecated disabled_signing_algorithms configuration option (#1804)
      * algorithms: add support for specific RSA algorithms
      * algorithms: add support for specific ECC curve algorithms
      * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
      * Manpage for keylime agent
      * Manpage for keylime verifier
      * Manpage for keylime registrar
      * Use constants for timeout and max retries defaults
      * verifier: Use timeout from `request_timeout` config option
      * revocation_notifier: Use timeout setting from config file
      * tenant: Set timeout when getting version from agent
      * verify/evidence: SEV-SNP evidence type/verifier
      * verify/evidence: Add evidence type to request JSON

    - Version v7.13.0:
      * Avoid re-encoding certificate stored in DB
      * Revert models: Do not re-encode certificate stored in DB
      * Revert registrar_agent: Use pyasn1 to parse PEM
      * policy/sign: use print() when writing to /dev/stdout
      * registrar_agent: Use pyasn1 to parse PEM
      * models: Do not re-encode certificate stored in DB
      * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
      * mb: support vendor_db as logged by newer shim versions
      * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
      * Remove unnecessary configuration values
      * cloud_verifier_tornado: handle exception in notify_error()
      * requests_client: close the session at the end of the resource manager
      * Manpage for keylime_tenant (#1786)
      * Add 2.5 templates including Push Model changes
      * Initial version of verify evidence API
      * db: Do not read pool size and max overflow for sqlite
      * Use context managers to close DB sessions
      * revocations: Try to send notifications on shutdown
      * verifier: Gracefully shutdown on signal
      * Use `fork` as `multiprocessing` start method
      * Fix inaccuracy in threat model and add reference to SBAT
      * Explain TPM properties and expand vTPM discussion
      * Fix invalid RST and update TOC
      * Expand threat model page to include adversarial model
      * Add --push-model option to avoid requests to agents
      * templates: duplicate str_to_version() in the adjust script
      * policy: fix mypy issues with rpm_repo
      * revocation_notifier: fix mypy issue by replacing deprecated call
      * Fix create_runtime_policy in python < 3.12
      * Fix after review
      * fixed CONSTANT names C0103 errors
      * Extend meta_data field in verifierdb
      * docs: update issue templates
      * docs: add GitHub PR template with documentation reminders
      * tpm_util: fix quote signature extraction for ECDSA
      * registrar: Log API versions during startup
      * Remove excessive logging on exception
      * scripts: Fix coverage information downloading script

    - Version v7.12.1:
      * models: Add Base64Bytes type to read and write from the database
      * Simplify response check from registrar

    - Version v7.12.0:
      * API: Add /version endpoint to registrar
      * scripts: Download coverage data directly from Testing Farm
      * docs: Add separate documentation for each API version
      * scripts/create_runtime_policy.sh: fix path for the exclude list
      * docs: add documentation for keylime-policy
      * templates: Add the new agent.conf option 'api_versions'
      * Enable autocompletion using argcomplete
      * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
      * Configure EPEL-10 repo in packit-ci.fmf
      * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
      * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
      * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
      * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
      * keylime-policy: improve error handling when provided a bad key (sign)
      * keylime-policy: exit with status 1 when the commands failed
      * keylime-policy: use Certificate() from models.base to validate certs
      * keylime-policy: check for valid cert file when using x509 backend (sign)
      * keylime-policy: fix help for keylime-policy sign verb
      * tenant: Correctly log number of tries when deleting
      * update TCTI environment variable usage
      * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
      * keylime-policy: add `create measured-boot' subcommand
      * keylime-policy: add `sign runtime' subcommand
      * keylime-policy: add logger to use with the policy tool
      * installer.sh: Restore execution permission
      * installer: Fix string comparison
      * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
      * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
      * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
      * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
      * installer.sh: updated EPEL, PEP668 Fix, logic fix
      * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
      * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
      * postgresql support for docker using psycopg2
      * installer.sh: update package list, add workaround for PEP 668
      * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
      * keylime.conf: full removal
      * Drop pending SPDX-License-Identifier headers
      * create_runtime_policy: Validate algorithm from IMA measurement log
      * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
      * create_runtime_policy: drop commment with test data
      * create_runtime_policy: Use a common method to guess algorithm
      * keylime-policy: rename tool to keylime-policy instead of keylime_policy
      * keylime_policy: create runtime: remove --use-ima-measurement-list
      * keylime_policy: use consistent arg names for create_runtime_policy
      * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
      * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
      * elchecking/example: workaround empty PK, KEK, db and dbx
      * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
      * create_runtime_policy: Fix log level for debug messages
      * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
      * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
      * pylintrc: Ignore too-many-positional-arguments check
      * keylime/web/base/controller: Move TypeAlias definition out of class
      * create_runtime_policy: Calculate digests in multiple threads
      * create_runtime_policy: Allow rootfs to be in any directory
      * keylime_policy: Calculate digests from each source separately
      * create_runtime_policy: Simplify boot_aggregate parsing
      * ima: Validate JSON when loading IMA Keyring from string
      * docs: include IDevID page also in the sidebar
      * docs: point to installation guide from RHEL and SLE Micro
      * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
      * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
      * change check_tpm_origin_check to a warning that does not prevent registration
      * docs: Fix Runtime Policy JSON schema to reflect the reality
      * Sets absolute path for files inside a rootfs dir
      * policy/create_runtime_policy: fix handling of empty lines in exclude list
      * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
      * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
      * codestyle: convert bytearrays to bytes to get expected type (pyright)
      * codestyle: Use new variables after changing datatype (pyright)
      * cert_utils: add description why loading using cryptography might fail
      * ima: list names of the runtime policies
      * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
      * tox: Use python 3.10 instead of 3.6
      * revocation_notifier: Use web_util to generate TLS context
      * mba: Add a skip custom policies option when loading mba.
      * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
      * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
      * cmd/keylime_policy: add tool to handle keylime policies
      * cert_utils: add is_x509_cert()
      * common/algorithms: transform Encrypt and Sign class into enums
      * common/algorithms: add method to calculate digest of a file
      * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
      * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
      * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
      * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
      * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
      * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
      * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
      * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
      * tpm: Replace KDFs and ECDH implementations with python-cryptography
      * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
      * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
      * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
      * build(deps): bump actions/first-interaction
      * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
      * revocation_notifier: Explicitly add CA certificate bundle
      * Introduce new REST API framework and refactor registrar implementation
      * mba: Support named measured boot policies
      * tenant: add friendlier error message if mTLS CA is wrongly configured
      * ca_impl_openssl: Mark extensions as critical following RFC 5280
      * Include Authority Key Identifier in KL-generated certs
      * verifier, tenant: make payload for agent completely optional

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
296453	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : keylime (SUSE-SU-2026:0217-1)	Nessus	SuSE Local Security Checks	high
283543	RHEL 10 : keylime (RHSA-2026:0429)	Nessus	Red Hat Local Security Checks	high
282766	MiracleLinux 9 : keylime-7.12.1-11.el9_7.3 (AXSA:2025-11565:05)	Nessus	Miracle Linux Local Security Checks	high
279615	AlmaLinux 10 : keylime (ALSA-2025:23201)	Nessus	Alma Linux Local Security Checks	high
279543	RHEL 9 : keylime (RHSA-2025:23735)	Nessus	Red Hat Local Security Checks	high
279524	RHEL 9 : keylime (RHSA-2025:23852)	Nessus	Red Hat Local Security Checks	high
279089	RHEL 9 : keylime (RHSA-2025:23628)	Nessus	Red Hat Local Security Checks	high
279080	RockyLinux 10 : keylime (RLSA-2025:23201)	Nessus	Rocky Linux Local Security Checks	high
278982	AlmaLinux 9 : keylime (ALSA-2025:23210)	Nessus	Alma Linux Local Security Checks	high
278981	Oracle Linux 10 : keylime (ELSA-2025-23201)	Nessus	Oracle Linux Local Security Checks	high
278954	RockyLinux 9 : keylime (RLSA-2025:23210)	Nessus	Rocky Linux Local Security Checks	high
278939	Oracle Linux 9 : keylime (ELSA-2025-23210)	Nessus	Oracle Linux Local Security Checks	high
278784	RHEL 9 : keylime (RHSA-2025:23210)	Nessus	Red Hat Local Security Checks	high
278758	SUSE SLES16 Security Update : keylime (SUSE-SU-2025:21194-1)	Nessus	SuSE Local Security Checks	medium
278753	RHEL 10 : keylime (RHSA-2025:23201)	Nessus	Red Hat Local Security Checks	high
278643	openSUSE 16 Security Update : keylime (openSUSE-SU-2025:20159-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2025-13609

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high

medium