A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:4413 advisory.

  - A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key     for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key     being imported. The highest threat from this vulnerability is to data confidentiality. (CVE-2021-3565)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tpm2-tools installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-3565 advisory.

  - A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key     for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key     being imported. The highest threat from this vulnerability is to data confidentiality. (CVE-2021-3565)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2021:4413 advisory.

  - A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key     for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key     being imported. The highest threat from this vulnerability is to data confidentiality. (CVE-2021-3565)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-4413 advisory.

  - A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key     for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key     being imported. The highest threat from this vulnerability is to data confidentiality. (CVE-2021-3565)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:4413 advisory.

  - tpm2-tools: fixed AES wrapping key in tpm2_import (CVE-2021-3565)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:4413 advisory.

  - tpm2-tools: fixed AES wrapping key in tpm2_import (CVE-2021-3565)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:1998-1 advisory.

  - A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key     for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key     being imported. The highest threat from this vulnerability is to data confidentiality. (CVE-2021-3565)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the tpm2 package has been released.

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:0934-1 advisory.

  - A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key     for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key     being imported. The highest threat from this vulnerability is to data confidentiality. (CVE-2021-3565)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:1998-1 advisory.

  - A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key     for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key     being imported. The highest threat from this vulnerability is to data confidentiality. (CVE-2021-3565)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:1999-1 advisory.

  - A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key     for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key     being imported. The highest threat from this vulnerability is to data confidentiality. (CVE-2021-3565)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
185001	Rocky Linux 8 : tpm2-tools (RLSA-2021:4413)	Nessus	Rocky Linux Local Security Checks	medium
172986	CBL Mariner 2.0 Security Update: tpm2-tools (CVE-2021-3565)	Nessus	MarinerOS Local Security Checks	medium
157469	AlmaLinux 8 : tpm2-tools (ALSA-2021:4413)	Nessus	Alma Linux Local Security Checks	medium
155393	Oracle Linux 8 : tpm2-tools (ELSA-2021-4413)	Nessus	Oracle Linux Local Security Checks	medium
155199	CentOS 8 : tpm2-tools (CESA-2021:4413)	Nessus	CentOS Local Security Checks	medium
155146	RHEL 8 : tpm2-tools (RHSA-2021:4413)	Nessus	Red Hat Local Security Checks	medium
151737	openSUSE 15 Security Update : tpm2.0-tools (openSUSE-SU-2021:1998-1)	Nessus	SuSE Local Security Checks	medium
151439	Photon OS 3.0: Tpm2 PHSA-2021-3.0-0263	Nessus	PhotonOS Local Security Checks	medium
151057	openSUSE 15 Security Update : tpm2.0-tools (openSUSE-SU-2021:0934-1)	Nessus	SuSE Local Security Checks	medium
150892	SUSE SLED15 / SLES15 Security Update : tpm2.0-tools (SUSE-SU-2021:1998-1)	Nessus	SuSE Local Security Checks	medium
150870	SUSE SLED15 / SLES15 Security Update : tpm2.0-tools (SUSE-SU-2021:1999-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2021-3565

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium