CVE-2026-21444

Katalog CVE

CVSS 5.5 · Medium EPSS 0,08%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm pada libtpms project libtpms. Skor CVSS 3.1 5.5 (Medium) menurut github.com.

Deskripsi (NVD)

libtpms, a library that provides software emulation of a Trusted Platform Module, has a flaw in versions 0.10.0 and 0.10.1. The commonly used integration of libtpms with OpenSSL 3.x contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps. The highest threat from this vulnerability is to data confidentiality. Version 0.10.2 fixes the issue. No known workarounds are available.

Rincian

Terbit di NVD

2 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CWE-330: Use of Insufficiently Random Values

EPSS (30 hari)

0,08% peluang dieksploitasi; lebih tinggi dari 0,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/stefanberger/libtpms/security/advisories/GHSA-7jxr-4j3g-p34f patch · advisory vendor
• https://github.com/stefanberger/libtpms/commit/33c9ff074cb16c1841ce7d7f33643c17c426743a patch
• https://github.com/stefanberger/libtpms/issues/541 exploit · issue tracking