CVE-2017-7524 tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC.
HighCVSS 7.5
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/tpm2-tools(Debian:12) | < 2.1.0-1 | 2.1.0-1 |
| debian/tpm2-tools(Debian:13) | < 2.1.0-1 | 2.1.0-1 |
| debian/tpm2-tools(Debian:14) | < 2.1.0-1 | 2.1.0-1 |
| tpm2-tools project tpm2.0-tools | <= 1.1.0 | No fix listed |
| TPM 2.0 Tools tpm2-tools | = before 1.1.1 | No fix listed |
References
- Debian Security Tracker CVE-2017-7524 vendor-advisory
- github.com patch third-party-advisory
- bugs.debian.org issue-tracking