Vulnerabilities

TI-2024-19221 CVE-2024-29039

Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state

HIGH 72

tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00984 Published 2024-06-28 Partial fix · 5.7 CWE-807

TI-2024-19220 CVE-2024-29038

tpm2 does not detect if quote was not generated by TPM

LOW 20

tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools.

CVSS 3.1MEDIUM 4.3 Local No auth No interaction EPSS 0.00373 Published 2024-06-28 Partial fix · 5.7 CWE-1283

TI-2021-02515 CVE-2021-3565 · GHSA-jxhq-r9c5-f85p

Hard-coded credentials in tpm2-tools

LOW 29

A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01327 Published 2021-06-04 Fixed CWE-665

TI-2017-05166 CVE-2017-7524 · GHSA-62m4-8mv5-x4gc

Insufficiently protected credentials in tpm2-tools

LOW 35

tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01242 Published 2017-06-27 Partial fix · 1.1.1 CWE-522

Vulnerabilities

Filters

Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state

tpm2 does not detect if quote was not generated by TPM

Hard-coded credentials in tpm2-tools

Insufficiently protected credentials in tpm2-tools