Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2024-29039

Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state

tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Redhat Tpm2-tools Project Tpm2 Software
Products
Enterprise Linux Tpm2-tools Tpm2 Tools
CVE-2024-29038

tpm2 does not detect if quote was not generated by TPM

tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote`. This issue was patched in version 5.7.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Tpm2-tools Project
Products
Enterprise Linux Tpm2-tools
CVE-2017-7524

tpm2-tools: Sending password in plaintext for HMAC generation on server

tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC.

CVSS 3.0 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Tpm2-tools Project
Products
Tpm2.0-tools
CVE-2021-3565

tpm2-tools: fixed AES wrapping key in tpm2_import

A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5.9 Medium EPSS 1.3% KEV · Not listed
Vendors
Fedoraproject Redhat Tpm2-tools Project
Products
Fedora Enterprise Linux Tpm2-tools