CVE-2023-38200: 
Python vulnerability analysis and mitigation

A security vulnerability (CVE-2023-38200) was discovered in Keylime, affecting its registrar component. The vulnerability was reported on July 13, 2023, and affects the Keylime TPM-based remote boot attestation and runtime integrity measurement solution. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections (NVD, Red Hat CVE).

The vulnerability occurs because Python SSL sockets block by default, unlike regular sockets. When a single connection is opened to the HTTPS interface, the Registrar becomes blocked and cannot serve any further clients, preventing normal operation. The issue has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD, GitHub PR).

The vulnerability allows an attacker to exhaust all available connections, effectively causing a denial of service condition that prevents the Keylime registrar from functioning properly. This impacts the system's ability to perform remote boot attestation and runtime integrity measurements (NVD).

The issue has been fixed in Keylime version 7.5.0 by implementing a non-blocking SSL handshake. Red Hat has released security updates for affected versions through RHSA-2023:5080. The fix was inspired by Python's documentation on non-blocking SSL sockets (Red Hat Advisory, GitHub PR).