SB2021070124 - Use of a broken or risky cryptographic algorithm in libtpms

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021070124

SB2021070124 - Use of a broken or risky cryptographic algorithm in libtpms

Published: July 1, 2021

Security Bulletin ID SB2021070124
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2021-3446)

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to decrypt data.

The vulnerability exists in libtpms due to integration with OpenSSL, which  contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps.


Remediation

Install update from vendor's website.

References