From: Peter Korsgaard <peter@korsgaard.com>
To: buildroot@busybox.net
Subject: [Buildroot] [PATCH 1/1] package/tpm2-tools: security bump to version 4.3.2
Date: Mon, 12 Jul 2021 23:05:10 +0200 [thread overview]
Message-ID: <87tukzw8e1.fsf@dell.be.48ers.dk> (raw)
In-Reply-To: <20210621202218.706458-1-fontaine.fabrice@gmail.com> (Fabrice Fontaine's message of "Mon, 21 Jun 2021 22:22:18 +0200")
>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:
> - Fix CVE-2021-3565: A flaw was found in tpm2-tools in versions before
> 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner
> wrapper, potentially allowing a MITM attacker to unwrap the inner
> portion and reveal the key being imported. The highest threat from
> this vulnerability is to data confidentiality.
> - LICENSE moved in doc directory since
> https://github.com/tpm2-software/tpm2-tools/commit/23aa5dca660f596b2ad89542d5100bd4ef0c871a
> and hash updated due to the following line added with
> https://github.com/tpm2-software/tpm2-tools/commit/305011b2a7d091740fa01dbfbd27a48a76f670f7
> Copyright 2019 Fraunhofer SIT sponsored by Infineon Technologies AG
> - libuuid and wchar (for mbstate_t) are mandatory since version 4.2 and
> https://github.com/tpm2-software/tpm2-tools/commit/eca77c1419617a8e2d6d8008bac716878b0c27ca
> https://github.com/tpm2-software/tpm2-tools/blob/4.3.2/doc/CHANGELOG.md
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
For 2021.02.x and 2021.05.x I have instead backported the security fix,
thanks.
--
Bye, Peter Korsgaard
prev parent reply other threads:[~2021-07-12 21:05 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-21 20:22 [Buildroot] [PATCH 1/1] package/tpm2-tools: security bump to version 4.3.2 Fabrice Fontaine
2021-07-03 20:32 ` Thomas Petazzoni
2021-07-12 21:05 ` Peter Korsgaard [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87tukzw8e1.fsf@dell.be.48ers.dk \
--to=peter@korsgaard.com \
--cc=buildroot@busybox.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox