Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/lf-edge/eve
  4. ›
  5. CVE-2023-43635

CVE-2023-43635: EVE Seals Vault Key With SHA1 PCRs

February 4, 2026

The vault key is sealed using SHA1 PCRs instead of SHA256 PCRs

Thus an attacker with physical access to an EVE-OS device can try to brute force creating a kernel or rootfs image which produces the same SHA1 PCR but with malicious content.

References

  • asrg.io/security-advisories/cve-2023-43635
  • asrg.io/security-advisories/vault-key-sealed-with-sha1-pcrs
  • github.com/advisories/GHSA-4jvr-vj2c-8q37
  • github.com/lf-edge/eve
  • github.com/lf-edge/eve/security/advisories/GHSA-4jvr-vj2c-8q37
  • nvd.nist.gov/vuln/detail/CVE-2023-43635

Code Behaviors & Features

Detect and mitigate CVE-2023-43635 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.0.0-20230519072751-977f42b07fa9

Fixed versions

  • 0.0.0-20230519072751-977f42b07fa9

Solution

Upgrade to version 0.0.0-20230519072751-977f42b07fa9 or above.

Impact 8.8 HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-327: Use of a Broken or Risky Cryptographic Algorithm
  • CWE-328: Use of Weak Hash
  • CWE-522: Insufficiently Protected Credentials

Source file

go/github.com/lf-edge/eve/CVE-2023-43635.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Thu, 05 Feb 2026 00:18:37 +0000.