Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.3757
tpm2-tools security and enhancement update
10 November 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: tpm2-tools
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2021-3565
Reference: ESB-2021.2154
Original Bulletin:
https://access.redhat.com/errata/RHSA-2021:4413
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: tpm2-tools security and enhancement update
Advisory ID: RHSA-2021:4413-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:4413
Issue date: 2021-11-09
CVE Names: CVE-2021-3565
=====================================================================
1. Summary:
An update for tpm2-tools is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64
3. Description:
The tpm2-tools packages add a set of utilities for management and
utilization of Trusted Platform Module (TPM) 2.0 devices from user space.
Security Fix(es):
* tpm2-tools: fixed AES wrapping key in tpm2_import (CVE-2021-3565)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.5 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1964427 - CVE-2021-3565 tpm2-tools: fixed AES wrapping key in tpm2_import
6. Package List:
Red Hat Enterprise Linux BaseOS (v. 8):
Source:
tpm2-tools-4.1.1-5.el8.src.rpm
aarch64:
tpm2-tools-4.1.1-5.el8.aarch64.rpm
tpm2-tools-debuginfo-4.1.1-5.el8.aarch64.rpm
tpm2-tools-debugsource-4.1.1-5.el8.aarch64.rpm
ppc64le:
tpm2-tools-4.1.1-5.el8.ppc64le.rpm
tpm2-tools-debuginfo-4.1.1-5.el8.ppc64le.rpm
tpm2-tools-debugsource-4.1.1-5.el8.ppc64le.rpm
s390x:
tpm2-tools-4.1.1-5.el8.s390x.rpm
tpm2-tools-debuginfo-4.1.1-5.el8.s390x.rpm
tpm2-tools-debugsource-4.1.1-5.el8.s390x.rpm
x86_64:
tpm2-tools-4.1.1-5.el8.x86_64.rpm
tpm2-tools-debuginfo-4.1.1-5.el8.x86_64.rpm
tpm2-tools-debugsource-4.1.1-5.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2021-3565
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYYrc/NzjgjWX9erEAQjhBRAApt69GbgVt0c5JggTG8UsRC4oQrKBb0cr
qUF0f9e/Ch3n551Ib1i2wT1dCRFAlVxNZ8U2YtzfLgVaAVASDw1QyNvtxu46Asbr
rHGlOQkCyEH1heZKvx4Q5xLPHif0mwbXs6qmF9uy/UJB71G6T51g9ddogMgC+d1b
S/E8/r1gawPLd08Tf/y/s7ho5U9RAbTAbBRKK/pTJ+zhpwaJXXLh90DXkyi2W6Bd
gWH4oYvD6kHpK+ZkXCLmaSkYT92NsTjQOC1d+EpdnTPspFnQ+sZFD+kwPqmroCLY
xDcIlyeuFJMMYB/kTZIgrzIjut8hqMsBRwYPXox080azVj0NUhlkB4XYytBiXbSk
LC2oXAkUzFIxYah90mVCkt3jboffqi99Rzv2XjjZoLzu7YR5MJQvi+fD92yGU3Q5
FVwzh2Grl5g4ZS9MaxGZfRA5+AlbxBc2n/VqFHNt7RLrksIvZZcPpCZ7p48ek10x
PZIyB8K7AwDH6Dpg16euwQvPE+fVvAB9E0G9c7K5dBOtkg+JaIUv62JsEJ/0Kxxv
wGShMDhi3+8YLxDROzdCaaO/KrZAOst3tqgBA6hxt/RWblI4UiJjuLtYHu8p8xAy
J08n+zouZftNOskb7Go74ioZFZaY+8Pvc7eyeUEjJ3nUixtACd/aS/SdvRaP3Yet
aiofJ54b4zA=
=VVSH
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYYs8HONLKJtyKPYoAQgoiw//V5JgEqFUG0985jBuolyIw75wJA9tmXQR
tEguctsPSIjdZnUTZ1XEtCK5rc0uCH0dnhIoMi+NkV3CKVaUCJvOJGz/353wSJjj
FGEjUUuWYrV15c5wCVQfuWOaRaU/cLBhxAYYYOQW4nbqYqdLjU31fnYhaM8glxiI
pBAw1UKSN20RZAo2hfUyHQuUIuoTxDU6cR0DxqrApc/P5KDWsG6UdQmKvoNYmwko
aYCgrCumFd0paWvE0TJJuDEss3vsOcRsR63MDZDOtIFrHzwQ/p9eeMkmdXFv4GKj
aXW2fIjGfMMH7TwG7O5psWdZPgghYc7H4f2eB3zDx5oT55d4/iBdKwJf49JDyxMw
Pd+ee48vXk0PtcmIoTf0oat/WykiU4jtlWc88j8FAvtk4FY2yZw7JytnG7k2lOgs
mqOCi2Ho0lKUPYlFXuCxAcd7d1WDP8pBiruAnxnq4EESJZHAlsjrIldatpuCDW3y
RoLKOuKNiCtJoPE+4asx/ZorTMmfmxdgzE7Aqkt1qS1/gGsNEdZRUGEaigbR7kFa
dYoaxW0GhrsEGpkpaybuh0hNsvnPeJIaYyqfyOTV8KYXU/zUdKRUavg/Hhxr9Ad6
Wmw2Ms/rR5WbQzRDBZiLSdV7NAoKTrlCwOG1zkeNHE+S7U5Hgb1cicLg9oFBBBtx
azJOTeELjQA=
=Bxxh
-----END PGP SIGNATURE-----