Registrar allows identity takeover via duplicate UUID registration

Resolves: RHEL-130761

Signed-off-by: Sergio Correia <scorreia@redhat.com>

keylime.spec

@@ -9,7 +9,7 @@
 
 Name:    keylime
 Version: 7.12.1
-Release: 12%{?dist}
+Release: 13%{?dist}
 Summary: Open source TPM software for Bootstrapping and Maintaining Trust
 
 URL:            https://github.com/keylime/keylime
@@ -41,6 +41,13 @@ Patch: 0011-revocations-Try-to-send-notifications-on-shutdown.patch
 Patch: 0012-requests_client-close-the-session-at-the-end-of-the-.patch
 Patch: 0013-fix-malformed-certs-workaround.patch
 
+# CVE-2025-13609
+# Backports from:
+# - https://github.com/keylime/keylime/pull/1817/commits/1024e19d
+# - https://github.com/keylime/keylime/pull/1825
+Patch: 0014-Add-shared-memory-infrastructure-for-multiprocess-co.patch
+Patch: 0015-Fix-registrar-duplicate-UUID-vulnerability.patch
+
 License: ASL 2.0 and MIT
 
 BuildRequires: git-core
@@ -93,7 +100,8 @@ Requires: openssl
 %if 0%{?with_selinux}
 # This ensures that the *-selinux package and all it’s dependencies are not pulled
 # into containers and other systems that do not use SELinux
-Recommends:       (%{srcname}-selinux if selinux-policy-%{selinuxtype})
+Recommends:       (%{srcname}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype})
+
 %endif
 
 %ifarch %efi
@@ -434,6 +442,10 @@ fi
 %license LICENSE
 
 %changelog
+* Tue Feb 03 2026 Sergio Correia <scorreia@redhat.com> - 7.12.1-13
+- Keylime: Registrar allows identity takeover via duplicate UUID registration
+  Resolves: RHEL-130761
+
 * Mon Feb 02 2026 Sergio Correia <scorreia@redhat.com> - 7.12.1-12
 - Change ownership of /usr/share/keylime/tpm_cert_store to root
   Resolves: RHEL-106024