CVE-2021-3565

2021-06-0411:39:40

CWE-665

redhat

www.cve.org

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.1%

JSON

A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.

CNA Affected

[
  {
    "product": "tpm2-tools",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "tpm2-tools 5.1.1, tpm2-tools 4.3.2"
      }
    ]
  }
]