CVE-2021-3446

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps. The highest threat from this vulnerability is to data confidentiality.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-327CWE-330

Affected software

VendorProductVersions
n/alibtpmslibtpms 0.8.2

References

Timeline

Published
Mar 25, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-344607.8Windows Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-344617.8Windows Container Isolation FS Filter Driver Elevation of Privilege VulnerabilityCVE-2021-344627.0Windows AppX Deployment Extensions Elevation of Privilege VulnerabilityCVE-2021-344647.8Microsoft Defender Remote Code Execution VulnerabilityCVE-2021-344665.7Windows Hello Security Feature Bypass VulnerabilityCVE-2021-344677.1Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2021-344687.1Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2021-344698.2Microsoft Office Security Feature Bypass VulnerabilityCVE-2021-34475.5A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on maCVE-2021-344708.0Microsoft Exchange Server Elevation of Privilege VulnerabilityCVE-2021-344717.8Microsoft Defender Elevation of Privilege VulnerabilityCVE-2021-344739.1Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-3446: Medium severity, CVSS 5.5 | Vulnix