CVE-2017-7524

tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC.

Score

CVSS 3.0 7.5 High

Status

Modified - secalert@redhat.com

Published

2017-06-27

Last modified

2024-08-05

Weaknesses

CWE-522

Affected products

• Tpm2.0-tools (Tpm2-tools Project)
• Tpm2-tools (Tpm 2.0 Tools)

References

• https://github.com/01org/tpm2.0-tools/commit/c5d72beaab1cbbbe68271f4bc4b6670d69985157