GHSA-4jvr-vj2c-8q37 — medium GitHub Advisory (CVE-2023-43635) in go/github.com/lf-edge/eve

Description

Impact

The vault key is sealed using SHA1 PCRs instead of SHA256 PCRs

Thus an attacker with physical access to an EVE-OS device can try to brute force creating a kernel or rootfs image which produces the same SHA1 PCR but with malicious content.

Patches

Fixed in 9.4.3-lts and 10.1.0

Workarounds

None

Basic information

Type: reviewed
Severity: medium
Advisory on GitHub: Open advisory ↗
Repository advisory: Open repository advisory ↗
Source code: Browse source ↗
Published (advisory): 2026-02-04 23:12:29 UTC
Updated: 2026-02-04 23:12:30 UTC
GitHub reviewed: 2026-02-04 23:12:29 UTC

Score	Percentile
0.01%	2.50%

CVSS Scores

Base score	Version	Severity	Vector
6.7	3.1	—	`CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N` Click to expand Attack vector (AV:P) Hands-on access—USB, keyboard, opening the case—not something you do purely over the wire. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:N) Service keeps running; no real outage angle.

Identifiers

Type	Value
GHSA	GHSA-4jvr-vj2c-8q37 ↗
CVE	CVE-2023-43635 ↗

CWEs

CWE id	Name
CWE-327	Use of a Broken or Risky Cryptographic Algorithm
CWE-328	Use of Weak Hash
CWE-522	Insufficiently Protected Credentials

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
go	github.com/lf-edge/eve	< 0.0.0-20230519072751-977f42b07fa9	0.0.0-20230519072751-977f42b07fa9	—

EVE Seals Vault Key With SHA1 PCRs