Edge Virtualization Engine (Linuxfoundation) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 206 known versions, newest CVE from 2023-09-21. Vendor: Linuxfoundation.

CVEs of Edge Virtualization Engine

• CVE-2023-43637 - CVSS 7.8 (high), 2023-09-21: Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be…
• CVE-2023-43632 - CVSS 9.9 (critical), 2023-09-21: As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port 8877 in EVE, exposing limited functionality of the TPM to the…
• CVE-2023-43631 - CVSS 8.8 (high), 2023-09-21: On boot, the Pillar eve container checks for the existence and content of “/config/authorized_keys”. If the file is present, and contains a supported public…
• CVE-2023-43636 - CVSS 8.8 (high), 2023-09-20: In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in the vault. As per the “measured boot”…
• CVE-2023-43630 - CVSS 8.8 (high), 2023-09-20: PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit…
• CVE-2023-43635 - CVSS 8.8 (high), 2023-09-20: Vault Key Sealed With SHA1 PCRs The measured boot solution implemented in EVE OS leans on a PCR locking mechanism. Different parts of the system update…