What is the vulnerability ID for this issue?

The vulnerability ID is CVE-2021-43393.

What software versions are affected by this vulnerability?

STMicroelectronics STSAFE-J 1.1.4 and J-SAFE3 1.2.5 are affected by this vulnerability.

What is the severity of CVE-2021-43393?

The severity of CVE-2021-43393 is medium with a severity value of 6.2.

Are there any references for this vulnerability?

Yes, you can find more information about this vulnerability at the following references: [1](https://community.st.com/s/toparticles) and [2](https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/).

Vulnerability/
CVE-2021-43393

medium

6.2

CWE

347

4/3/2022

4/8/2024

CVE-2021-43393

First published: Fri Mar 04 2022(Updated: )

STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to abuse signature verification. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform.

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
St Stsafe-j Firmware	=1.1.4
St Stsafe-j
St J-safe3 Firmware	=1.2.5
St J-safe3

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2021-43393.
What software versions are affected by this vulnerability?
STMicroelectronics STSAFE-J 1.1.4 and J-SAFE3 1.2.5 are affected by this vulnerability.
What is the severity of CVE-2021-43393?
The severity of CVE-2021-43393 is medium with a severity value of 6.2.
How can attackers abuse signature verification with this vulnerability?
Attackers can abuse signature verification through the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API.
Are there any references for this vulnerability?
Yes, you can find more information about this vulnerability at the following references: [1](https://community.st.com/s/toparticles) and [2](https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/).

collector/nvd-index
agent/weakness
agent/severity
agent/event
agent/references
agent/author
agent/type
agent/description
agent/last-modified-date
agent/softwarecombine
agent/first-publish-date
agent/tags
collector/mitre-cve
source/MITRE
vendor/st
canonical/st stsafe-j firmware
version/st stsafe-j firmware/1.1.4
canonical/st stsafe-j
canonical/st j-safe3 firmware
version/st j-safe3 firmware/1.2.5
canonical/st j-safe3

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.