PT-2017-17788 · Tpm2 · Tpm2-Tools

Published 2017-06-27 · Updated 2024-06-15 · CVE-2017-7524

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions tpm2-tools versions prior to 1.1.1

Description The issue is related to a password leak. When generating HMAC, the password is transmitted in plaintext from the client to the server.

Recommendations For versions prior to 1.1.1, update to version 1.1.1 or later to resolve the issue.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2017-7524

OPENSUSE-SU-2024:11471-1

Affected Products

Tpm2-Tools

References · 11

• https://github.com/01org/tpm2.0-tools/commit/c5d72beaab1cbbbe68271f4bc4b6670d69985157 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7524 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11471-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7524 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7524 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-7524 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-7524 · Security Note
• https://ubuntu.com/security/CVE-2017-7524 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7524 · Security Note
• https://suse.com/security/cve/CVE-2017-7524 · Note
• https://suse.com/security/cve/CVE-2021-3565 · Note