Tpm2-Tools Project: Security Vulnerabilities
A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.
CVSS Score
5.9
EPSS Score
0.002
Published
2021-06-04
tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC.
CVSS Score
7.5
EPSS Score
0.002
Published
2017-06-27