{"id":"CVE-2021-3505","aliases":["DEBIAN-CVE-2021-3505","EUVD-2021-26824","GHSA-239j-gmhr-4pcm","MGASA-2021-0590","OESA-2022-1959","openSUSE-SU-2024:11004-1"],"status":"published","title":"A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit...","description":"A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00404,"percentile":0.35079,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-331"],"published":"2021-04-19T20:22:05Z","modified":"2026-10-23T18:03:37Z","fixes":[{"ecosystem":"Debian:12","package":"libtpms","fixed_in":["0.8.0~dev1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libtpms","fixed_in":["0.8.0~dev1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libtpms","fixed_in":["0.8.0~dev1-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"libtpms","fixed_in":["0.7.3-7.oe1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~dev1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~dev1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~dev1-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-1.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:8","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-5.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.3-7.oe1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libtpms_project","product":"libtpms"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"stefanberger","product":"libtpms"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1950046","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/stefanberger/libtpms/issues/183","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NUCZX4S53TUNTSGTCRDNOQZV2V2RI4RJ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3505","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NUCZX4S53TUNTSGTCRDNOQZV2V2RI4RJ/","tags":["web"]},{"url":"https://github.com/advisories/GHSA-239j-gmhr-4pcm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3505","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0590.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28882","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/46YMIRHQHNKPCVNRVW4W27MFQQU7ZHHV/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/Z7KZSYMTE7Z4BBEZUWO2DIMQDWMGEP46/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/DZI42OR3JUEGWRKEVCOHL2FPTJVYCYBT/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/7UCZ7AV2UKWYYCNZ2NLLXW7QYCX7K337/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/75RD2O2OFCMWPCMY5QMSZRNV5PG5BTS6/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/YVJSXDXD44WDR4VA2XL33IZDJTBGRXP7/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/7E3B6T5RBDKAWETDTW3WPORY3NK5IR46/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1959","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3746","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-3505","description":"A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality.","status":"published","published":"2021-04-19T20:22:05Z","modified":"2024-08-03T16:53:17.854Z","cwes":["CWE-331"],"updated_at":"2026-11-02T14:33:03.671751Z"}],"euvd":[{"id":"EUVD-2021-26824","description":"A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality.","status":"published","published":"2021-04-19T20:22:05Z","modified":"2024-08-03T16:53:17Z","updated_at":"2026-11-03T03:25:13.052236Z"}],"ghsa":[{"id":"GHSA-239j-gmhr-4pcm","title":"A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit...","description":"A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality.","status":"published","published":"2022-05-24T17:47:53Z","modified":"2023-01-29T05:06:25Z","cwes":["CWE-331"],"updated_at":"2026-11-02T14:46:01.014857Z"}],"nvd":[{"id":"CVE-2021-3505","description":"A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality.","status":"published","published":"2021-04-19T21:15:13.27Z","modified":"2026-06-17T04:05:15.063Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T14:06:52.03307Z"}],"osv":[{"id":"CVE-2021-3505","description":"A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality.","status":"published","published":"2021-04-19T21:15:13.27Z","modified":"2026-10-20T10:50:08.603195842Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-3505","description":"A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality.","status":"published","published":"2021-04-19T21:15:13.27Z","modified":"2026-10-23T18:03:37.791860008Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"OESA-2022-1959","title":"libtpms security update","description":"A library providing TPM functionality for VMs. Targeted for integration into Qemu.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality.(CVE-2021-3505)","status":"published","published":"2022-09-23T11:05:16Z","modified":"2026-08-18T01:17:18.679178114Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"MGASA-2021-0590","title":"Updated libtpms/swtpm packages fix security vulnerability","description":"CryptSym: fix AES output IV (CVE-2021-3505).\nFixed a context save and suspend/resume problem when public keys are\nloaded.\nReset too large size indicators in TPM2B to avoid access beyond buffer\n(CVE-2021-3623)\nRestore original value in buffer if unmarshalled one was illegal\nFixed out-of-bounds access via specially crafted TPM 2 command packets\n(CVE-2021-3746)\nMarshal event sequence objects' hash state\n","status":"published","published":"2021-12-30T16:41:51Z","modified":"2026-04-16T04:42:15.129626592Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:11004-1","title":"libtpms-devel-0.8.4-2.2 on GA media","description":"These are all security issues fixed in the libtpms-devel-0.8.4-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:12:56.602838Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}