tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NTpm2 Tools Project Tpm2.0 Tools
APPTpm2-Tools Projectβ€ 1.1.0
π΅
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2024-29039CRITICAL9.0PL βten sam vendor
Manipulacja wynikami tpm2_checkquote w tpm2-tools (TPM2.0)
CVE-2024-29038MEDIUM4.3ten sam vendor
tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can g...
CVE-2021-3565MEDIUM5.9ten sam vendor
A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for...