CVEvulnerability

CVE-2021-3446

5.5 MEDIUM Published 2021-03-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-03-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-327, CWE-330

Description

A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps. The highest threat from this vulnerability is to data confidentiality.

Affected configurations

• libtpms project libtpms (< 0.8.2) • redhat enterprise linux 8.0 • fedoraproject fedora 33

Related

Weakness · CWE (2)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness
  • CWE-330 Use of Insufficiently Random Values weakness

References