CVE-2019-11090
Medium
Description
Cryptographic timing conditions in the subsystem for Intel(R) PTT before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0 and 14.0.10; Intel(R) TXE 3.1.70 and 4.0.20; Intel(R) SPS before versions SPS_E5_04.01.04.305.0, SPS_SoC-X_04.00.04.108.0, SPS_SoC-A_04.00.04.191.0, SPS_E3_04.01.04.086.0, SPS_E3_04.08.04.047.0 may allow an unauthenticated user to potentially enable information disclosure via network access.
SeverityMedium
CVSS5.9
Exploit probability—
ProductIntel Platform Trust Technology Firmware
PublishedDec 18, 2019
First seenDec 18, 2019
How to fix
Update
- intel platform_trust_technology_firmware11.11.70, 11.22.70, 12.0.45, 13.0.0, 14.0.10 or later
- intel server_platform_services_firmwaresps_e3_04.01.04.086.0, sps_e5_04.01.04.305.0, sps_soc-a_04.00.04.191.0, sps_soc-x_04.00.04.108.0 or later
- intel trusted_execution_engine_firmware3.1.70, 4.0.20 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| intel platform_trust_technology_firmware | 11.0 ≤ v ≤ 11.8.70, 11.10 ≤ v < 11.11.70, 11.20 ≤ v < 11.22.70, 12.0 ≤ v < 12.0.45, 13.0 ≤ v < 13.0.0, 14.0.0 ≤ v < 14.0.10 | 11.11.70, 11.22.70, 12.0.45, 13.0.0, 14.0.10 |
| intel server_platform_services_firmware | No range specified, sps_e3_04.01.00.000.0 ≤ v < sps_e3_04.01.04.086.0, sps_e5_04.00.00.000.0 ≤ v < sps_e5_04.01.04.305.0, sps_soc-a_04.00.00.000.0 ≤ v < sps_soc-a_04.00.04.191.0, sps_soc-x_04.00.00.000.0 ≤ v < sps_soc-x_04.00.04.108.0 | sps_e3_04.01.04.086.0, sps_e5_04.01.04.305.0, sps_soc-a_04.00.04.191.0, sps_soc-x_04.00.04.108.0 |
| intel trusted_execution_engine_firmware | 3.0 ≤ v < 3.1.70, 4.0 ≤ v < 4.0.20 | 3.1.70, 4.0.20 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.