CVE-2019-25052

Опубликовано: 11 авг. 2021

Источник: nvd

CVSS3: 9.1

CVSS2: 6.4

EPSS Низкий

Описание

In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information.

Ссылки

https://github.com/OP-TEE/optee_os/commit/34a08bec755670ea0490cb53bbc68058cafc69b6
Patch
Third Party Advisory
https://github.com/OP-TEE/optee_os/security/advisories/GHSA-pgwr-qmgh-vhmf
Patch
Third Party Advisory
https://github.com/OP-TEE/optee_os/commit/34a08bec755670ea0490cb53bbc68058cafc69b6
Patch
Third Party Advisory
https://github.com/OP-TEE/optee_os/security/advisories/GHSA-pgwr-qmgh-vhmf
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:linaro:op-tee:*:*:*:*:*:*:*:*

Версия до 3.7.0 (исключая)

EPSS

Процентиль: 42%

0.00203

Низкий

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-327

Связанные уязвимости

CVE-2019-25052

CVSS3: 9.1

debian

больше 4 лет назад

In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data ...

GHSA-qx3f-hv27-2wg9

github

больше 3 лет назад