CVE-2021-3565
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2021-3565
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-3565.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2021-3565
- Related
- Published
- 2021-06-04T12:15:07Z
- Modified
- 2025-01-08T08:11:20.246187Z
- Downstream
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.
- References
-
- https://bugzilla.redhat.com/show_bug.cgi?id=1964427
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ESY6HRYUKR5ZG2K5QAJQC5S6HMKZMFK7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XK5M7I66PBXSN663TSLAZ3V6TWWFCV7C/
- https://security-tracker.debian.org/tracker/CVE-2021-3565
Affected packages
Debian:11 / tpm2-tools
Package
- Name
- tpm2-tools
- Purl
- pkg:deb/debian/tpm2-tools?arch=source
Debian:12 / tpm2-tools
Package
- Name
- tpm2-tools
- Purl
- pkg:deb/debian/tpm2-tools?arch=source
Debian:13 / tpm2-tools
Package
- Name
- tpm2-tools
- Purl
- pkg:deb/debian/tpm2-tools?arch=source
Git / github.com/tpm2-software/tpm2-tools
Affected ranges
- Type
- GIT
- Repo
- https://github.com/tpm2-software/tpm2-tools
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
2.*
2.0.0
2.0.0-beta_0
3.*
3.0
3.0-rc0
3.0-rc1
3.0-rc2
3.0.1
3.0.2
4.*
4.0
4.0-rc0
4.0-rc1
4.0-rc2
4.1
4.1-rc0
4.1-rc1
4.1.1
4.1.1-RC0
4.1.1-RC1
4.2
4.2-RC0
4.2-rc1
4.2.1
4.2.1-rc0
4.2.1-rc1
4.3.0
4.3.0-rc0
4.3.0-rc1
4.3.1
4.3.1-rc0
4.3.2-rc0
v1.*
v1.0.0
v1.0.1
v1.1-beta_0
v1.1-beta_1
v1.1.0