CVE-2021-37847: Pengutronix Barebox

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification.

Affected products

• Pengutronix Barebox: up to and including 2021.07.0

Published 2021-08-02. Last modified 2026-06-17.