SB2021070124 - Use of a broken or risky cryptographic algorithm in libtpms
Published: July 1, 2021
Security Bulletin ID
SB2021070124
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2021-3446)
The vulnerability allows a remote attacker to decrypt data.
The vulnerability exists in libtpms due to integration with OpenSSL, which contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps.
Remediation
Install update from vendor's website.