CVE-2023-43635: EVE Seals Vault Key With SHA1 PCRs
The vault key is sealed using SHA1 PCRs instead of SHA256 PCRs
Thus an attacker with physical access to an EVE-OS device can try to brute force creating a kernel or rootfs image which produces the same SHA1 PCR but with malicious content.
References
Code Behaviors & Features
Detect and mitigate CVE-2023-43635 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →