CVE-2021-43392: Medium severity st j-safe3 vulnerability
STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to obtain information on cryptographic secrets. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-43392?
The severity of CVE-2021-43392 is medium with a severity value of 6.2.
Which software versions are affected by CVE-2021-43392?
The STMicroelectronics STSAFE-J firmware version 1.1.4 and J-SAFE3 firmware version 1.2.5 are affected by CVE-2021-43392.
How can attackers exploit CVE-2021-43392?
Attackers can exploit CVE-2021-43392 to obtain information on cryptographic secrets.
Are the STMicroelectronics J-SAFE3 and STSAFE-J platforms vulnerable to CVE-2021-43392?
No, the STMicroelectronics J-SAFE3 and STSAFE-J platforms are not vulnerable to CVE-2021-43392.
Is there any fix available for CVE-2021-43392?
Yes, please refer to the official STMicroelectronics community website and the CERT-FR advisory for more information on available fixes.