-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| keylime | pip | < 7.4.0 | 7.4.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the SSL socket configuration in the 'start' function where 'do_handshake_on_connect=True' (default) caused blocking during SSL handshakes. However, during exploitation, the blocking occurs in the Python 'ssl' module's internal handshake logic rather than within Keylime's application code. The patch introduces a non-blocking handshake handler in 'ProtectedHandler.handle()', but the original vulnerable code path does not contain Keylime-specific functions in the runtime stack during attack execution. The actual resource exhaustion occurs at the SSL/TLS layer (standard library), not in observable application functions.