Every CVE Search/ Get API key

CVE-2021-3565

A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a...

5.9 MediumFix available

A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.33%Up 0.9 points since Jun 5, 2021
90%50%10%1%

What each source reports

NVD Score used 5.9

A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.

Record
CVE-2021-3565
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-665, CWE-798
Updated
2026-11-02
CVE List No score

A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.

Record
CVE-2021-3565
Weakness
CWE-665
Updated
2026-11-02
EUVDEUVD-2021-26875 No score

A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.

Record
EUVD-2021-26875
Updated
2026-11-03
GitHub AdvisoriesGHSA-jxhq-r9c5-f85p 5.9

A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a...

A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.

Record
GHSA-jxhq-r9c5-f85p
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-798
Updated
2026-11-02
OSVAZL-6923 5.9

CVE-2021-3565 affecting package tpm2-tools for versions less than 4.2-2

A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.

Record
AZL-6923
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSV 5.9

A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.

Record
CVE-2021-3565
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 12 moreShow less
OSVDEBIAN-CVE-2021-3565 5.9

A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.

Record
DEBIAN-CVE-2021-3565
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2021-1384 5.9

tpm2-tools security update

The package contains the code for the TPM (Trusted Platform Module) 2.0 tools based on tpm2-tss.

The tpm2-tools projects aims to deliver both low-level and aggregate command line tools that provide access to a tpm2.0 compatible device.

Security Fix(es):

A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.(CVE-2021-3565)

Record
OESA-2021-1384
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2021:4413 4.4

Red Hat Security Advisory: tpm2-tools security and enhancement update

Record
RHSA-2021:4413
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2021:4413 4.4

Moderate: tpm2-tools security and enhancement update

The tpm2-tools packages add a set of utilities for management and utilization of Trusted Platform Module (TPM) 2.0 devices from user space.

Security Fix(es):

  • tpm2-tools: fixed AES wrapping key in tpm2_import (CVE-2021-3565)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

Record
RLSA-2021:4413
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2021-3565 5.9

A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.

Record
UBUNTU-CVE-2021-3565
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2021:4413 No score

Moderate: tpm2-tools security and enhancement update

The tpm2-tools packages add a set of utilities for management and utilization of Trusted Platform Module (TPM) 2.0 devices from user space.

Security Fix(es):

  • tpm2-tools: fixed AES wrapping key in tpm2_import (CVE-2021-3565)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2021:4413
Updated
2026-11-02
OSVMGASA-2021-0353 No score

Updated tpm2-tools package fixes security vulnerability

A flaw was found in tpm2-tools. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality (CVE-2021-3565).

Record
MGASA-2021-0353
Updated
2026-11-02
OSVopenSUSE-SU-2021:0934-1 No score

Security update for tpm2.0-tools

This update for tpm2.0-tools fixes the following issues:

  • CVE-2021-3565: Fixed issue when no encrypted session with the TPM is used (bsc#1186490).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:0934-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:1998-1 No score

Security update for tpm2.0-tools

This update for tpm2.0-tools fixes the following issues:

  • CVE-2021-3565: Fixed issue when no encrypted session with the TPM is used (bsc#1186490).
Record
openSUSE-SU-2021:1998-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11471-1 No score

tpm2.0-tools-5.1.1-3.2 on GA media

These are all security issues fixed in the tpm2.0-tools-5.1.1-3.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11471-1
Updated
2026-11-02
OSVSUSE-SU-2021:1998-1 No score

Security update for tpm2.0-tools

This update for tpm2.0-tools fixes the following issues:

  • CVE-2021-3565: Fixed issue when no encrypted session with the TPM is used (bsc#1186490).
Record
SUSE-SU-2021:1998-1
Updated
2026-11-02
OSVSUSE-SU-2021:1999-1 No score

Security update for tpm2.0-tools

This update for tpm2.0-tools fixes the following issues:

  • CVE-2021-3565: Fixed issue when no encrypted session with the TPM is used (bsc#1186490).
Record
SUSE-SU-2021:1999-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tpm2-tools
AlmaLinux:8
 before 4.1.1-5.el8
4.1.1-5.el8
tpm2-tools
Azure Linux:2
 before 4.2-2
4.2-2
tpm2-tools
Debian:12
 before 5.0-2
5.0-2
tpm2-tools
Debian:13
 before 5.0-2
5.0-2
tpm2-tools
Debian:14
 before 5.0-2
5.0-2
tpm2-tools
Mageia:8
 before 5.0-1.1.mga8
5.0-1.1.mga8
tpm2-tools
openEuler:20.03-LTS-SP1
 before 5.0-3.oe1
5.0-3.oe1
tpm2-tools
openEuler:20.03-LTS-SP2
 before 5.0-3.oe1
5.0-3.oe1
tpm2-tools
Red Hat:enterprise_linux:8::baseos
 before 0:4.1.1-5.el8
0:4.1.1-5.el8
tpm2-tools-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:4.1.1-5.el8
0:4.1.1-5.el8
Show 14 moreShow less
Affected packages
PackageAffectedFixed
tpm2-tools-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:4.1.1-5.el8
0:4.1.1-5.el8
tpm2-tools
Rocky Linux:8
 before 0:4.1.1-5.el8
0:4.1.1-5.el8
tpm2.0-tools
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 4.3.0-4.3.1
4.3.0-4.3.1
tpm2.0-tools
SUSE:Linux Enterprise Module for Basesystem 15 SP2
 before 4.1-3.3.1
4.1-3.3.1
tpm2-tools
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.0.0+20160226.64b3334-0ubuntu11.0.0+20160226.64b3334-0ubuntu2
 None known
tpm2-tools
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.1.3-24.0.1-14.1-14.1.1-14.1.1-1ubuntu0.20.04.1
 None known
tpm2-tools
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.0-25.2-15.2-1build1
 None known
tpm2-tools
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.4-15.6-15.6-1build15.6-1build35.6-1build4
 None known
tpm2-tools
Ubuntu:25.10
 All versions, plus listed versions
5.7-1
 None known
tpm2-tools
Ubuntu:26.10
 All versions, plus listed versions
5.7-1build15.7-1ubuntu15.7-1ubuntu2
 None known
tpm2-tools
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.7-15.7-1build1
 None known
tpm2.0-tools
openSUSE:Leap 15.2
 before 4.1-lp152.2.3.1
4.1-lp152.2.3.1
tpm2.0-tools
openSUSE:Leap 15.3
 before 4.3.0-4.3.1
4.3.0-4.3.1
tpm2.0-tools
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 5.1.1-3.2
5.1.1-3.2

History

History
RecordedChangedSources
affected, facts
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3565 is a medium vulnerability (CVSS 5.9) in Tpm2-software Tpm2-tools, published June 4, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.33%, the 71st percentile. Fixed in tpm2-tools 4.1.1-5.el8.

References

Show 25 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open