CVE-2021-3798

2022-08-2315:48:58

CWE-200

redhat

www.cve.org

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_DeriveKey is used with ECDH public data. This may allow a malicious user to extract the private key by performing an invalid curve attack.

CNA Affected

[
  {
    "product": "opencryptoki",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in v3.17.0"
      }
    ]
  }
]