5.9
CVE-2021-3565
- EPSS 0.22%
- Published 04.06.2021 12:15:07
- Last modified 21.11.2024 06:21:51
- Source secalert@redhat.com
- Teams watchlist Login
- Open Login
A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.
Data is provided by the National Vulnerability Database (NVD)
Tpm2-tools Project ≫ Tpm2-tools Version < 4.3.2
Tpm2-tools Project ≫ Tpm2-tools Version >= 5.1 < 5.1.1
Redhat ≫ Enterprise Linux Version8.0
Fedoraproject ≫ Fedora Version33
Fedoraproject ≫ Fedora Version34
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.22% | 0.447 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 5.9 | 2.2 | 3.6 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:P/I:N/A:N
|
CWE-665 Improper Initialization
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
CWE-798 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.