Vulnerability · Published Mar 25, 2021 · Assigned by redhat

CVE-2021-3446

Medium 5.5

In plain English

A medium-severity broken cryptography in libtpms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium

Exploit odds (30 days)0.1%top 95.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps. The highest threat from this vulnerability is to data confidentiality.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	libtpms	0.8.2-1	DEBIAN-CVE-2021-3446
Debian:13	libtpms	0.8.2-1	DEBIAN-CVE-2021-3446
Debian:14	libtpms	0.8.2-1	DEBIAN-CVE-2021-3446
Ubuntu:22.04:LTS	libtpms	0.9.3-0ubuntu1	UBUNTU-CVE-2021-3446

Affected products (as reported)

Vendor	Product	Versions
n/a	libtpms	libtpms 0.8.2

Weakness: CWE-327

References

https://bugzilla.redhat.com/show_bug.cgi?id=1939664 x_refsource_MISC