CVE-2021-3505

State: Published
Severity: Not scored
Published: Apr 19, 2021
Updated: Aug 3, 2024
Reserved: Apr 16, 2021

Description

A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality.

Scores

The record has no CVSS score.

Weaknesses

CWE-331

Affected Products

Product	Versions
libtpmsn/a	libtpms 0.8.0Affected

References

https://bugzilla.redhat.com/show_bug.cgi?id=1950046
https://github.com/stefanberger/libtpms/issues/183
FEDORA-2021-cfdc434610vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.