CVE-2017-7524: High severity Tpm2-tools Project Tpm2.0-tools vulnerability
Published Jun 27, 2017
·Updated
tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC.
Affected Software
1 affected component
Tpm2-tools Project Tpm2.0-tools<=1.1.0
Remediation
Event History
Jun 27, 2017
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-7524?
CVE-2017-7524 has a high severity rating due to the risk of password leaks during plaintext transmission.
2
How do I fix CVE-2017-7524?
You can fix CVE-2017-7524 by upgrading tpm2-tools to version 1.1.1 or later.
3
What vulnerability does CVE-2017-7524 expose in tpm2-tools?
CVE-2017-7524 exposes a vulnerability that allows passwords to be transmitted in plaintext, potentially leading to unauthorized access.
4
Which versions of tpm2-tools are affected by CVE-2017-7524?
CVE-2017-7524 affects all versions of tpm2-tools before 1.1.1.
5
Is CVE-2017-7524 related to HMAC generation?
Yes, CVE-2017-7524 is specifically related to the insecure handling of passwords during HMAC generation.