PT-2022-11830 · Stmicroelectronics · Stsafe-J+2

Published 2022-03-04 · Updated 2022-03-10 · CVE-2021-43393

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions STMicroelectronics STSAFE-J version 1.1.4 STMicroelectronics J-SAFE3 version 1.2.5 STMicroelectronics J-SIGN (affected versions not specified)

Description The issue is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms, which exposes a 3.0.4 Java Card API. This allows attackers to abuse signature verification. It is exploitable for STSAFE-J in closed configuration and J-SIGN when signature verification is activated, but not for J-SAFE3 EPASS BAC and EAC products. The issue might also impact other products based on the J-SAFE-3 Java Card platform.

Recommendations For STMicroelectronics STSAFE-J version 1.1.4, consider disabling the ECDSA signature algorithm until a patch is available. For STMicroelectronics J-SAFE3 version 1.2.5, restrict access to the Java Card API to minimize the risk of exploitation. For STMicroelectronics J-SIGN, deactivate signature verification as a temporary workaround until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2021-43393

Affected Products

J-Safe3

J-Sign

Stsafe-J

References · 7

• https://osv.dev/vulnerability/CVE-2021-43393 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43393 · Security Note
• https://community.st.com/s/toparticles · Vendor Advisory
• https://cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169 · Note
• https://t.me/cvenotify/28022 · Telegram Post
• https://t.me/cvenotify/27747 · Telegram Post
• https://t.me/cibsecurity/38417 · Telegram Post