CVE-2021-3565: Fedoraproject Fedora

Medium severity, CVSS 5.9. EPSS: 1.3% chance of exploitation in the next 30 days.

A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.

Affected products

• Fedoraproject Fedora: version 33 only; version 34 only
• Red Hat Enterprise Linux: version 8.0 only
• TPM2-Tools Project TPM2-Tools: before 4.3.2 (fixed in 4.3.2); from 5.1, before 5.1.1 (fixed in 5.1.1)

Published 2021-06-04. Last modified 2026-06-17.